---
id: CVE-2026-63722
title: >-
  ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability
  that allows unauthenticated attackers to execute arbitrary OS commands by
  chaining an authentication bypass, CSRF validation bypass, and unsanitized
  command exe…
summary: >-
  ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability
  that allows unauthenticated attackers to execute arbitrary OS commands by
  chaining an authentication bypass, CSRF validation bypass, and unsanitized
  command exe…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-08-19'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63722'
references:
  - url: 'https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/icecoder/ICEcoder'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/icecoder-unauthenticated-rce-via-terminal-xhr-php
    label: disclosure@vulncheck.com
  - url: 'https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.01329
epssPercentile: 0.69906
ingestedAt: '2026-09-24T20:51:40.210Z'
---

## Overview

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.