CVE-2026-64838

ICEcoder versions through 8.1 contain a path traversal flaw (CWE-22) in the handling of the oldFileName parameter used by file move and rename operations. An authenticated user can supply traversal sequences in oldFileName to reference files outside the document root, causing ICEcoder to move a file that the PHP process can write into the web-accessible project directory. This exposes the moved file's contents through the web server and removes it from its original location, yielding both information disclosure and file deletion on the host. Any deployment of ICEcoder 8.1 or earlier in which the PHP process can write to files containing sensitive data is affected, and exploitation requires valid application credentials. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV catalog.

What to do: Check your deployed ICEcoder version; no fixed release is specified in the available data, so apply a patched version from the project as soon as one becomes available. In the meantime, restrict ICEcoder access to trusted authenticated users and limit the PHP process's write permissions outside the document root (for example, on session, configuration, or log files), since any PHP-writable file could be moved into the web root and read or deleted. Review move/rename activity and web server logs for signs that files outside the document root were accessed or relocated.