CVE-2026-63722: ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to procopen() to achieve remote code execution as the web-server user.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected ICEcoder terminal endpoint. No authentication or user interaction is required; the exploit uses a single HTTP POST request containing a password parameter, a non-empty csrf parameter, and an arbitrary command.
Under which account do injected commands run?
Commands execute as the web-server user. The resulting system impact depends on that account's permissions and access to local files, services, and credentials.
Is this exploitable without a valid user account or a valid CSRF token?
Yes. The authentication check can be bypassed with the password parameter, and CSRF validation is bypassed by supplying any non-empty csrf parameter.