Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-64836ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

High 8.8

In plain English

A high-severity path traversal in ICEcoder from ICEcoder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 50.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

Affected products (as reported)

Vendor	Product	Versions
ICEcoder	ICEcoder	8.0 – through 8.1

Weakness: CWE-22, CWE-697 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64836.md third-party-advisory
https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/classes/File.php#L70 technical-description
VulnCheck Advisory: ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement third-party-advisory