CVE Alert: CVE-2026-64836 – ICEcoder

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

High-risk exposure requiring prompt remediation, but there is no supplied evidence of active exploitation; KEV status, EPSS and PoC indicators are not provided.

A network-reachable attacker with a valid low-privilege account may access or manipulate files beyond the intended web workspace. Likely objectives include stealing configuration files and credentials, altering application code, planting web-accessible content, deleting data, or disrupting service. The impact is greatest where the editor can access shared hosting, secrets, backups or other sensitive application directories.

### Most likely attack path

The attack is remotely accessible (AV:N), has low complexity (AC:L), requires limited privileges (PR:L), and needs no user interaction (UI:N). An attacker would authenticate, submit crafted relative or absolute file paths to the file-management function, then read, modify or remove files; Scope is unchanged, so direct impact remains on the vulnerable host and its accessible filesystem rather than automatically crossing a security authority boundary.

### Who is most exposed

Internet-facing installations, shared web-hosting environments, developer portals and administrative tools using weak, reused or widely distributed accounts are most exposed. Risk increases where the process identity can read application secrets or write executable web content.

Review file-management requests containing traversal sequences, encoded separators or absolute paths.

Alert on access to files outside the configured document root.

Correlate unusual editor logins with bulk reads, writes or deletions.

Check for newly created scripts, altered configuration files and unexpected web content.

Inspect web-server and application logs for anomalous source addresses.

### Mitigation and prioritisation

Upgrade to a vendor-supported fixed release; if unavailable, plan migration away from the unsupported component.

Restrict the editor endpoint to VPN or administrative networks and enforce strong, unique authentication.

Run the service under a minimally privileged account with filesystem and write permissions tightly scoped.

Disable the file-control function where feasible and deploy temporary request filtering for traversal patterns.

Back up critical files, validate integrity, and test changes in staging before production rollout.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.