CVE-2026-64837: ICEcoder through 8.1 OS Command Injection via lib/properties.php
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ICEcoder user can exploit it. The attacker needs permission to create a directory with shell metacharacters in its name and access the Properties function.
What level of access can an attacker obtain?
Injected commands run as the web-server user. This can affect confidentiality, integrity, and availability of resources accessible to that account.
Are installations affected by user-created directory names?
Yes. The vulnerable path is passed to a shell command without escaping, so directory names containing shell metacharacters can be used as the injection vector.
How can I check for possible exploitation?
Review directory names available to ICEcoder users for shell metacharacters and inspect web-server activity for unexpected commands run through the Properties function. The vulnerable code path is lib/properties.php.