Description
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Published: 2026-09-10
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Read, write, or delete files outside the document root leading to confidentiality and integrity compromise
Action: Immediate Patch
AI Analysis

Impact

ICEcoder versions up to 8.1 contain a logic flaw in the File::check() validation, comparing realpath() against boolean true. This condition never succeeds, allowing attackers who can authenticate to supply traversal sequences or absolute paths. The flaw permits reading, the configured document root, exposing sensitive data and potentially enabling further attacks.

Affected Systems

The vulnerability affects ICEcoder software from ICEcoder:ICEcoder for all releases through version 8.1. No legacy versions are cited as less affected.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, meaning current exploitation likelihood is unknown. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a remote authenticated session; an attacker must first authenticate to the editor interface before delivering the malicious file parameter.

Generated by OpenCVE AI on September 10, 2026 at 15:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ICEcoder to version 8.2 or later where the File::check() logic flaw is fixed.
  • Enforce strict role‑based access controls to limit who can log into the editor, reducing the pool of potential attackers.
  • If an immediate upgrade is not possible, apply a temporary patch by modifying File.php to correctly differentiate realpath() results from boolean true, ensuring traversal and absolute paths are blocked until an official release is available.

Generated by OpenCVE AI on September 10, 2026 at 15:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Title ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
First Time appeared Icecoder
Icecoder icecoder
Weaknesses CWE-22
CWE-697
CPEs cpe:2.3:a:icecoder:icecoder:*:*:*:*:*:*:*:*
Vendors & Products Icecoder
Icecoder icecoder
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Icecoder Icecoder
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-10T14:05:49.993Z

Reserved: 2026-07-20T18:27:48.161Z

Link: CVE-2026-64836

cve-icon Vulnrichment

Updated: 2026-09-10T14:05:44.511Z

cve-icon NVD

Status : Received

Published: 2026-09-10T14:17:03.317

Modified: 2026-09-10T15:17:35.947

Link: CVE-2026-64836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T16:00:14Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-697

    Incorrect Comparison