---
id: CVE-2026-64838
title: >-
  ICEcoder versions through 8.1 fail to properly validate the oldFileName
  parameter in file move and rename operations, allowing authenticated users to
  relocate files from outside the document root
summary: >-
  ICEcoder versions through 8.1 fail to properly validate the oldFileName
  parameter in file move and rename operations, allowing authenticated users to
  relocate files from outside the document root. Attackers can use path
  traversal sequenc…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-22
vendor: ICEcoder
product: icecoder/icecoder
affected:
  - icecoder/icecoder >= 8.0 <= 8.1
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:58:20.507'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64838'
references:
  - url: >-
      https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md
    label: disclosure@vulncheck.com
  - url: 'https://github.com/icecoder/ICEcoder'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/file-control.php#L198
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/icecoder-through-8.1-path-traversal-via-oldfilename-parameter
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T14:59:48.110899Z'
ingestedAt: '2026-09-10T14:51:56.257Z'
epss: 0.0052
epssPercentile: 0.41708
---

## Overview

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.