---
id: CVE-2026-64837
title: >-
  ICEcoder through 8.1 passes an unescaped filesystem path into a shell command
  in lib/properties.php, allowing authenticated users to inject OS commands
  through directory names
summary: >-
  ICEcoder through 8.1 passes an unescaped filesystem path into a shell command
  in lib/properties.php, allowing authenticated users to inject OS commands
  through directory names. Attackers can create directories with shell
  metacharacters i…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: ICEcoder
product: icecoder/icecoder
affected:
  - icecoder/icecoder >= 8.0 <= 8.1
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:58:20.507'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64837'
references:
  - url: >-
      https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md
    label: disclosure@vulncheck.com
  - url: 'https://github.com/icecoder/ICEcoder'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/properties.php#L37
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/icecoder-through-8.1-os-command-injection-via-lib-properties-php
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T14:54:44.049643Z'
ingestedAt: '2026-09-10T14:51:56.257Z'
epss: 0.00539
epssPercentile: 0.44318
---

## Overview

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.