CVE-2026-64836

ICEcoder, a self-hosted web-based PHP code editor, contains a path traversal flaw (CWE-22) in its file-control endpoint in all versions through 8.1. The document-root confinement check is broken because the File::check() validation function compares realpath()'s return value to boolean true, a comparison that can never succeed since realpath() returns either a path string or false, so submitted paths are never actually confined. An authenticated attacker can therefore submit traversal sequences (such as ../) or absolute paths in the file parameter to read, write, or delete arbitrary files outside the configured document root, using the privileges of the web application. Any deployment of ICEcoder 8.1 or earlier is affected; exploitation requires valid low-privilege credentials and no user interaction, and the flaw is scored 8.7 (High) in CVSS 4.0. The issue is not in CISA's KEV, no public proof-of-concept is known, and there are currently no reports of in-the-wild exploitation.

What to do: Upgrade to an ICEcoder release newer than 8.1 once a patched version is published, as the advisory names no fixed version. In the meantime, restrict ICEcoder access to trusted users (e.g., IP allowlisting or VPN) since exploitation requires an authenticated session, review web-server logs for requests to the file-control endpoint containing ../ or absolute paths, and audit files writable by the web-server user for unexpected modifications or deletions.