CVE-2026-64836

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-64836

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64836.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-64836

Published

2026-09-10T13:51:05Z

Modified

2026-09-12T03:46:47Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

Details

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22",
        "CWE-697"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64836.json"
}

References

Affected packages

Git / github.com/icecoder/icecoder

Affected ranges

Type

GIT

Repo

https://github.com/icecoder/icecoder

Events

Introduced

d4c4911eadb23629bb31134181e2745a7f7bc1e3

Fixed

f1bab2dec53d8e6fe5bdcc53a3f929cfd83701f3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "8.0"
        },
        {
            "last_affected": "8.1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "8.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

8.*

8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64836.json"