CVE-2026-64836
Received Received - Intake

Path Traversal Vulnerability in ICEcoder Through 8.1

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-64836
EUVD
EUVD-2026-75453

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
icecoder icecoder to 8.2 (exc)
caycon icecoder to 8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64836 is a path traversal vulnerability in ICEcoder versions through 8.1. It occurs due to a logic error in the File::check() validation function where realpath() is incorrectly compared to boolean true. This comparison always fails because realpath() returns either a path string or false, not true. As a result, the document-root confinement check is bypassed, allowing authenticated attackers to use traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the intended directory.

Detection Guidance

Check for unauthorized file access attempts in web server logs, particularly for paths containing ../ or absolute paths. Inspect File.php in ICEcoder installations for the flawed realpath() comparison logic. Use tools like grep to search for file parameter manipulation in requests targeting ICEcoder endpoints.

Impact Analysis

This vulnerability allows authenticated attackers to access, modify, or delete files outside the web root directory. This could lead to unauthorized data exposure, system compromise, or disruption of services. Attackers might steal sensitive files, inject malicious code, or deface websites. Exploitation requires authentication but poses significant risks to file system integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. Exploitation may result in data breaches, triggering legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update ICEcoder to a patched version if available. If no patch exists, disable ICEcoder or restrict access to authenticated users only. Implement strict input validation for file parameters and enforce document-root confinement in web server configurations. Monitor for suspicious file operations outside the web root.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart