ICEcoder CVE-2026-64838

Exploitation requires a valid low-privilege authenticated session on the ICEcoder instance (CVSS PR:L confirmed). The attacker must have network access to the ICEcoder web interface (AV:N). The specific condition is that the oldFileName parameter in the file move or rename API endpoint in lib/file-control.php accepts user-supplied path strings without normalization or boundary enforcement. The target file must be readable and writable by the PHP process user account; files owned by root or protected with restrictive OS permissions (e.g., mode 600 owned by root) are not movable by the web process and thus not exploitable via this path. Exploitation is bounded by the OS-level filesystem permissions of the PHP process - it cannot escape into files that process cannot access. No non-default configuration or special feature flag is required beyond a functional ICEcoder installation with an active user account.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L reflects a network-reachable, low-complexity attack that requires only a low-privilege authenticated session, with high impact on both confidentiality and integrity. The primary real-world constraint is authentication: an attacker must first obtain valid ICEcoder credentials, which in practice may not be a significant barrier since ICEcoder is a developer tool whose user base already has legitimate access to the filesystem interface. Because ICEcoder is purpose-built to grant authenticated users broad file access, the "low privilege" threshold represents any registered IDE user rather than a tightly scoped role, which diminishes this barrier meaningfully. Even a mid-sized municipal IT team in gliwice running ICEcoder on an internet-facing development server should treat this as urgent, since the blast radius extends to any file readable and writable by the PHP process - potentially including database credentials, SSH keys, or application secrets. VA:L accurately captures that the original file is deleted as a side effect of the move rather than as a denial-of-service primitive. No active exploitation (CISA KEV) is confirmed and no standalone exploit code has been published, but the detailed source code reference in the Caycon advisory substantially lowers the reproduction barrier.

An authenticated ICEcoder user - even one with no special administrative role - issues a rename or move request with oldFileName set to a traversal string such as ../../var/www/config/database.php, targeting a PHP-process-readable configuration file outside the document root. The server moves the file into the web-accessible project directory without path validation, after which the attacker retrieves its contents via a plain HTTP GET request. The original file is deleted from its source location as part of the move, potentially breaking dependent application functionality.