Description
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Published: 2026-09-10
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Title ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
First Time appeared Icecoder
Icecoder icecoder
Weaknesses CWE-22
CWE-697
CPEs cpe:2.3:a:icecoder:icecoder:*:*:*:*:*:*:*:*
Vendors & Products Icecoder
Icecoder icecoder
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Icecoder Icecoder
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-10T14:05:49.993Z

Reserved: 2026-07-20T18:27:48.161Z

Link: CVE-2026-64836

cve-icon Vulnrichment

Updated: 2026-09-10T14:05:44.511Z

cve-icon NVD

Status : Received

Published: 2026-09-10T14:17:03.317

Modified: 2026-09-10T15:17:35.947

Link: CVE-2026-64836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses