Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-64836

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

CVSS 4.0 8.7 HIGHCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-64836

Published

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-64836

Published

icecoder/icecoder

https://packagist.org/packages/icecoder/icecoder

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ICEcoder",
                    "product": "ICEcoder",
                    "packageName": "icecoder/icecoder",
                    "collectionURL": "https://packagist.org/packages/icecoder/icecoder",
                    "packageURL": "pkg:composer/icecoder/icecoder",
                    "repo": "https://github.com/icecoder/ICEcoder",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "8.0",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThanOrEqual": "8.1"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON