CVE-2026-64838 Details

A path traversal vulnerability has been identified in ICEcoder versions through 8.1. The issue arises in the file move and rename functionalities, where the application fails to properly validate the 'oldFileName' parameter. This lack of validation allows authenticated users to manipulate file paths, moving files writable by the PHP process from outside the document root into the web-accessible project directory. As a result, file contents can be disclosed, and original files can be deleted.

To address this vulnerability, ICEcoder should implement proper path validation by canonicalizing the 'oldFileName' parameter with 'realpath()' before any filesystem operations. Requests should be rejected if the canonicalization fails. Additionally, both the source and destination paths should be verified to ensure they are within the allowed document root before performing any file operations.