CVE-2026-64838
Received Received - Intake

ICEcoder Path Traversal Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-64838
EUVD
EUVD-2026-75455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
icecoder icecoder to 8.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64838 is a path traversal vulnerability in ICEcoder versions through 8.1. It occurs because the oldFileName parameter in file move and rename operations is not properly validated. Attackers can use path traversal sequences like /../ to move files from outside the document root into the web-accessible project directory. This allows them to access or modify sensitive files depending on PHP process permissions.

Detection Guidance

To detect this vulnerability, inspect ICEcoder file operations for improper path validation in file move and rename functions. Check logs for suspicious file paths containing traversal sequences like /../ or encoded equivalents. Review file-control.php for missing realpath() calls on oldFileName before filesystem operations.

Impact Analysis

This vulnerability can allow attackers to move files writable by the PHP process into accessible locations. This could lead to disclosure of sensitive file contents, deletion of original files, or unauthorized filesystem reorganization. Attackers with low privileges could exploit this to access or manipulate files outside the intended document root.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, including those containing personal data or protected health information. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could expose protected health information, violating the Security Rule. Both standards mandate strict access controls and breach reporting.

Mitigation Strategies

Immediately upgrade ICEcoder to a patched version if available. As a temporary fix, implement strict input validation for oldFileName parameter, rejecting any paths containing traversal sequences. Ensure file operations use realpath() to canonicalize paths and verify they reside within the document root before execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart