Icecoder Through 8.1 Os Command Injection Via Lib Properties Php

Back www.vulncheck.com

Icecoder Through 8.1 Os Command Injection Via Lib Properties Php

www.vulncheck.com • September 10, 2026

Share: View original

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Icecoder Vulnerabilities: Path Traversal and OS Command Injection Discovered Two critical vulnerabilities have been identified in Icecoder versions through 8.1. The first, a path traversal vulnerability (CWE-22), allows unauthorized file access due to ineffective file check confinement. The second, an OS command injection vulnerability (CWE-78), arises from improper handling of special elements in the lib properties PHP file. Both vulnerabilities could potentially lead to significant security breaches, affecting users of Icecoder. No specific CVEs were mentioned in the articles, and there is no indication of active exploitation at this time. Security professionals are advised to monitor the situation closely and apply any forthcoming patches. The vulnerabilities were disclosed on September 10, 2026. 2 sources 40

Extracted Entities

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Vulnerabilities (1)

OS Command Injection