CVE-2026-64837 Details

A command injection vulnerability has been identified in ICEcoder versions 8.0 through 8.1. The issue arises in the 'lib/properties.php' file, where an unescaped filesystem path is passed into a shell command. This vulnerability allows authenticated users to inject operating system commands through directory names. By creating directories with shell metacharacters in their names and accessing the Properties function, attackers can execute arbitrary commands as the web server user using the popen() function.

The vulnerability can be remediated by escaping the directory name argument using 'escapeshellarg()' before passing it to 'popen()'. However, a more effective solution would be to eliminate the shell execution entirely and use a pure-PHP approach to calculate directory sizes.