CVEvulnerability
CVE-2026-64838
8.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-10
- Last modified
- 2026-09-10
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Weaknesses
- CWE-22
Description
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md github.com
- https://github.com/icecoder/ICEcoder github.com
- https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/file-control.php#L198 github.com
- https://www.vulncheck.com/advisories/icecoder-through-8.1-path-traversal-via-oldfilename-parameter www.vulncheck.com
- https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md github.com