EUVD-2026-75453
GHSA-wx3p-7qfr-rqrp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no complexity barriers, requires low-privilege authentication; full C/I/A impact via arbitrary file read, write, and delete on the server filesystem.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.
AnalysisAI
Path traversal in ICEcoder through version 8.1 allows authenticated low-privilege attackers to read, write, or delete arbitrary files on the host filesystem by submitting traversal sequences or absolute paths to the file-control endpoint. The root cause is a PHP logic error in File::check() where the document-root confinement check compares the return value of realpath() against boolean true - a comparison that can never evaluate to true in PHP, since realpath() returns a string or false - rendering the entire path-restriction mechanism permanently inoperative. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid ICEcoder user account with at least low-privilege access (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scoring 8.7 is well-calibrated to the actual vulnerability mechanics: network-accessible exploitation requiring only low-privilege authentication with no complexity barriers and no additional preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the ICEcoder GitHub repository at https://github.com/icecoder/ICEcoder should be monitored for a corrective commit that replaces the broken realpath() comparison with a proper path-prefix check against the document root string. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ICEcoder deployments running version 8.1 or earlier and classify by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
ICEcoder v8.1 allows attackers to execute a directory traversal. Rated high severity (CVSS 7.5), this vulnerability is r
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. Rated medium severity (
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php. Rated medium severity (CVSS 6.1), thi
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php. Rated medium severity (CVSS 6.1),
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient
Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands
Path traversal in ICEcoder through version 8.1 enables authenticated low-privilege users to move arbitrary files from ou
OS command injection in ICEcoder through 8.1 allows authenticated low-privilege users to execute arbitrary operating sys
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today