CVE-2026-64836highCWE-22CWE-697

CVE-2026-64836: high-severity vulnerability in ICEcoder

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

Published

Follow this CVE+ Monitor ICEcoder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ICEcoder · ICEcoder
Related CVEs — ICEcoder

In the same product, most dangerous first.

CVE-2026-63722HIGHICEcoder 8.1 Unauthenticated RCE via terminal-xhr.phpEPSS 1.3%CVE-2026-64837HIGHICEcoder through 8.1 OS Command Injection via lib/properties.phpEPSS 0.8%CVE-2026-64838HIGHICEcoder through 8.1 Path Traversal via oldFileName ParameterEPSS 0.5%