Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck
CVE-2026-64837ICEcoder through 8.1 OS Command Injection via lib/properties.php
High 8.8
In plain English
A high-severity OS command injection in ICEcoder from ICEcoder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Product Repository product
- https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md third-party-advisory
- https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/properties.php#L37 technical-description
- VulnCheck Advisory: ICEcoder through 8.1 OS Command Injection via lib/properties.php third-party-advisory