Path Traversal Vulnerability in ICEcoder (CVE-2026-64836)

CVE-2026-64836 is a path traversal vulnerability affecting ICEcoder up to and including version 8.1. The flaw exists within the file-control endpoint, specifically due to a logic error in the File::check() validation function. This function attempts to verify that requested file paths remain within the defined document root by comparing realpath() results to boolean true, a comparison that consistently fails. As a result, the confinement check is bypassed. An authenticated attacker can exploit this by submitting traversal sequences (e.g., ../) or absolute paths in the file parameter. Successful exploitation allows for the reading, writing, or deletion of sensitive files on the underlying filesystem, potentially leading to remote code execution or complete system compromise. Organizations running these versions should restrict access to the file-control endpoint or upgrade to a remediated version once available.

Attack Chain

1. Attacker gains authenticated access to the ICEcoder web interface.
2. Attacker identifies the file-control endpoint as a target for file interaction.
3. Attacker crafts an HTTP request targeting the file parameter.
4. Attacker inserts directory traversal sequences or absolute file paths into the file parameter.
5. The server-side File::check() function executes but fails to properly validate the input due to the logic error.
6. The application processes the request, applying the operation (read, write, or delete) to the targeted file path.
7. Attacker achieves unauthorized file access, modification, or destruction outside the intended document root.

Impact

Successful exploitation allows authenticated attackers to escape the application's document root, leading to unauthorized access to sensitive configuration files, source code, or system binaries. Depending on the environment, an attacker could delete essential system files or write malicious web shells to attain remote code execution, threatening the integrity and availability of the host server.

Recommendation

• Deploy the Sigma rule below to monitor for suspicious path traversal patterns in web server logs targeting the ICEcoder file-control endpoint.
• Restrict network access to the ICEcoder instance to trusted IP ranges only.
• Monitor file system integrity for modifications in directories outside the intended ICEcoder web root.