CVE-2026-64838: ICEcoder through 8.1 Path Traversal via oldFileName Parameter
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated ICEcoder account with access to file move or rename operations. Exploitation is network-accessible, requires low privileges, and does not require user interaction.
What is the practical impact beyond reading files?
The attacker can move files writable by the PHP process from outside the document root into a web-accessible project directory. This can disclose their contents and deletes the original files as part of the move.
Are installations affected by default?
The provided information identifies ICEcoder versions through 8.1 as affected, but does not state whether the vulnerable file move and rename functionality is enabled or reachable in a default deployment.
How can I assess exposure while remediation is pending?
Review authenticated use of ICEcoder file move and rename operations, especially requests whose oldFileName value contains path traversal sequences. Also identify files outside the document root that are writable by the PHP process, since those are candidates for relocation and disclosure.