CVE-2026-64838
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.
| CWE | CWE-22 |
| Vendor | icecoder |
| Product | icecoder |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for icecoder icecoder
Be the first to know when new high vulnerabilities affecting icecoder icecoder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
ICEcoder / ICEcoder
8.0 ≤ 8.1
References
github.com: https://github.com/icecoder/ICEcoder github.com: https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md github.com: https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/file-control.php#L198 vulncheck.com: https://www.vulncheck.com/advisories/icecoder-through-8.1-path-traversal-via-oldfilename-parameter
Credits
ByteMe.Red