CVE-2026-64836: ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to ICEcoder and able to send requests to the file-control endpoint. No user interaction is required, and the attack can be performed over the network.
What impact can successful exploitation have?
An authenticated attacker can use traversal sequences or absolute paths in the file parameter to access files outside the configured document root. Depending on the requested operation, this can allow reading, modifying, or deleting those files.
Are installations using the configured document-root restriction protected?
No. The vulnerability is caused by a logic error in the File::check() document-root confinement validation, so the intended restriction does not successfully block out-of-root paths in affected versions through 8.1.
What can be done while patching is unavailable?
Restrict ICEcoder access to trusted authenticated users and limit network exposure to the file-control endpoint. Run the service with filesystem permissions that prevent its account from reading, writing, or deleting sensitive files outside the intended project area.