CVE-2026-64837

EUVD-2026-75454
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
icecodericecoder
8.0 ≤
𝑥
≤ 8.1
CNA
Common Weakness Enumeration
References
https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md
https://github.com/icecoder/ICEcoder
https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/properties.php#L37
https://www.vulncheck.com/advisories/icecoder-through-8.1-os-command-injection-via-lib-properties-php