CVE-2026-64836 Details

A path traversal vulnerability has been identified in ICEcoder versions through 8.1. The issue arises from a logic error in the document-root confinement check within the file-control endpoint. The vulnerability allows authenticated attackers to bypass intended file operation restrictions and manipulate files outside the designated document root. This is achieved by exploiting the File::check() validation function, which incorrectly compares the output of realpath() to a boolean true, a comparison that can never succeed. As a result, the path-jail enforcement intended to prevent unauthorized file access is rendered ineffective.

To address this vulnerability, the path validation logic in the File::check() function should be corrected to properly handle the return value of realpath(). The comparison should verify that realpath() does not return false before proceeding with the document-root check. Additionally, the same validation should be applied to all file paths involved in operations such as renaming, moving, uploading, saving, deleting, copying, and extracting files.