CVE Alert: CVE-2026-64837 – ICEcoder

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().

## AI Summary Analysis

**Risk verdict:** High-risk remote command execution requiring low-level authenticated access; prioritise remediation promptly, although current enrichment indicates no known exploitation and no active KEV listing.

**Why this matters:** Successful exploitation could give an attacker complete control of the application’s web-server execution context, enabling data theft, content tampering, credential harvesting, persistence, or service disruption. The impact is particularly serious where the application can access source code, deployment secrets, writable web directories, or internal services. SSVC assesses technical impact as total, but exploitation is currently marked none and automation as no; EPSS is not provided, so probability remains uncertain.

**Most likely attack path:** An attacker reaches the exposed web interface over the network with basic authenticated privileges, prepares attacker-controlled filesystem input, then invokes the affected functionality without requiring another user’s action. Low attack complexity and no special environmental conditions make exploitation plausible; unchanged scope limits direct authority crossing, but the web-server account may still provide a foothold for local discovery and lateral movement.

**Who is most exposed:** Internet-facing or broadly accessible installations used as browser-based code or file managers are the priority, especially those hosting sensitive repositories or running beside production applications.

Review web and application logs for unusual access to the Properties function.

Alert on shell processes spawned by the web-server account.

Hunt for newly created directories containing shell metacharacters or abnormal names.

Check for outbound connections, unexpected child processes, and modified web content.

Mitigation and prioritisation:

Apply the vendor or maintainer’s fixed release as soon as validated; if none exists, plan replacement or isolation.

Restrict access to trusted administrators through VPN, ACLs, or a reverse proxy.

Run the service with least privilege and separate it from sensitive files and credentials.

Add application-layer command-execution monitoring and test changes in staging before deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.