CVE-2026-64837

ICEcoder, a self-hosted web-based PHP code editor, passes an unescaped filesystem path into a shell command in lib/properties.php, allowing OS command injection (CWE-78) via popen(). An authenticated user triggers the flaw by creating a directory whose name contains shell metacharacters and then opening the Properties function for that path, causing the injected commands to run on the server. Successful exploitation yields arbitrary command execution with the privileges of the web-server user, which can lead to compromise of hosted files and potential lateral movement. Any deployment running ICEcoder version 8.1 or earlier with untrusted or semi-trusted authenticated users is affected. There is no evidence of active exploitation: the issue is not in CISA's KEV catalog, no public proof-of-concept is known, and exploitation status is currently 'none known'.

What to do: No fixed version is specified in the available data, so monitor the ICEcoder project (GitHub/website) for a patched release beyond 8.1 and upgrade as soon as one is published. Until then, limit ICEcoder access to fully trusted authenticated users, avoid creating or syncing directories whose names contain shell metacharacters (e.g., ; | & $ ` backticks and quotes), run the web-server user with least privilege, and check hosting logs for unexpected child processes (popen/shell executions) or unusually named directories as signs of exploitation.