ICEcoder versions before 8.1 contain a flaw in lib/properties.php that passes an unescaped filesystem path directly into a shell command through popen(); this allows authenticated users to craft directory names containing shell metacharacters and then invoke the Properties function to execute arbitrary OS commands with the privileges of the web–server process, providing full read/write/execute access to the underlying system.

The affected product is ICEcoder, a web–based editor; all installations of ICEcoder up to and including version 8.1 are vulnerable. No specific later versions are mentioned, so newer releases such as 8.2 and later are assumed to have fixed the issue.

The CVSS score of 8.7 classifies this as a High‑severity vulnerability. Exploitation requires authenticated access to the web application, but once authenticated the attacker can trivially execute arbitrary commands. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the KEV status indicates it has not been widely exploited yet; nevertheless, the ability to run commands as the web‑server user presents a significant threat that requires immediate action.