ICEcoder CVE-2026-63722

The ICEcoder application must be network-reachable from the attacker - no firewall or VPN blocking access to the web interface. The terminal endpoint (terminal XHR PHP handler) must be present and accessible, which is a default component of ICEcoder 8.1. No valid credentials are required: the authentication check is bypassed by the presence of a password POST parameter rather than a verified token. No valid CSRF token is required: the CSRF check is bypassed by any non-empty string in the csrf POST parameter. Exploitation is limited to the permissions of the web-server process (e.g., www-data), which restricts direct privilege escalation but still permits file read/write, reverse shell establishment, and lateral movement within the server's permission boundary. Non-default configuration is not required - this appears to affect a default ICEcoder installation.

Real-world risk for exposed ICEcoder instances is very high. The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) reflects low attack complexity and no required user interaction, though the PR:L rating is in tension with the description's explicit claim that attackers are unauthenticated - a discrepancy worth verifying with the vendor, since the description implies the authentication mechanism is entirely bypassed rather than requiring any legitimate low-privilege credential. If truly unauthenticated (PR:N equivalent), the effective exploitability is closer to a 9.8-level scenario. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified here. The existence of a public GitHub Gist strongly suggests proof-of-concept code is available, which substantially lowers the barrier to exploitation. ICEcoder is a niche tool with limited enterprise footprint, meaning the absolute number of vulnerable instances is likely small - but any team that has deployed it and exposed it to the network faces immediate, credible risk, and even a mid-sized municipal IT team in radom that self-hosts developer tooling should treat this as urgent remediation.

An attacker with network access to the ICEcoder instance sends a single HTTP POST request to the terminal endpoint, including a password field (triggering the auth bypass), a non-empty csrf field (skipping CSRF validation), and an arbitrary OS command string. PHP's proc_open() executes the command as the web-server user, returning output to the attacker. A public proof-of-concept gist appears to exist, making this trivially reproducible.