Directory Traversal

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Directory Traversal via the File::check function. An attacker can access, modify, or delete files outside the intended directory by submitting traversa...

Command Injection

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Command Injection via the Properties process in lib/properties.php. An attacker can execute arbitrary operating system commands as the web server user ...

Directory Traversal

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Directory Traversal via the oldFileName parameter in file move and rename operations. An attacker can access or relocate files outside the intended...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64837

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

EUVD-2026-75455

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838

ICEcoder (a web-based code editor) versions through 8.1 are affected by a path traversal vulnerability in the oldFileName parameter used during file move and rename operations. Because the parameter is not properly validated, an authenticated attacker can inject path traversal sequences to reloca...

CVE-2026-64837

ICEcoder through 8.1 is vulnerable to OS command injection in lib/properties.php . The root cause is an unescaped filesystem path passed to a shell command via popen() . An authenticated attacker can create directories containing shell metacharacters in their names and then invoke the Properties ...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

EUVD-2026-75454

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint. The root cause is a logic error in the File::check() validation function, which compares realpath() to boolean true—a condition that never succeeds, effectively disabling the document-root confineme...

CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

EUVD-2026-75453

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...