ICEcoder vulnerabilities
We track 4 vulnerabilities in ICEcoder products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2026.
Latest ICEcoder vulnerabilities
- 8.3 High severity
ICEcoder: Improper Limitation of a Pathname to a Restricted Directory
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to mo
- 8.8 High severity
ICEcoder: Improper Neutralization of Special Elements used in an OS Command
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and acces
- 8.8 High severity
ICEcoder: Improper Limitation of a Pathname to a Restricted Directory
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allo
- 9.8 Critical severity
ICEcoder: Missing Authentication for Critical Functionality
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can s