---
id: CVE-2026-64836
title: >-
  ICEcoder versions through 8.1 contain a path traversal vulnerability in the
  file-control endpoint due to a logic error in the document-root confinement
  check
summary: >-
  ICEcoder versions through 8.1 contain a path traversal vulnerability in the
  file-control endpoint due to a logic error in the document-root confinement
  check. The File::check() validation function compares realpath() to boolean
  true, whi…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
  - CWE-697
vendor: ICEcoder
product: icecoder/icecoder
affected:
  - icecoder/icecoder >= 8.0 <= 8.1
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:58:20.507'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64836'
references:
  - url: >-
      https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64836.md
    label: disclosure@vulncheck.com
  - url: 'https://github.com/icecoder/ICEcoder'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/classes/File.php#L70
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/icecoder-through-8.1-path-traversal-via-ineffective-file-check-confinement
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T14:05:40.293919Z'
ingestedAt: '2026-09-10T14:51:56.257Z'
epss: 0.00606
epssPercentile: 0.46693
---

## Overview

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.