Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-64838ICEcoder through 8.1 Path Traversal via oldFileName Parameter

High 8.3

In plain English

A high-severity path traversal in ICEcoder from ICEcoder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

Affected products (as reported)

Vendor	Product	Versions
ICEcoder	ICEcoder	8.0 – through 8.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

Product Repository product
https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md third-party-advisory
https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/file-control.php#L198 technical-description
VulnCheck Advisory: ICEcoder through 8.1 Path Traversal via oldFileName Parameter third-party-advisory