CVE-2026-64837
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-78
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- ICEcoder ICEcoder
Weakness type
Related vulnerabilities
- CVE-2026-88889 — Renovate before 44.14.7 Command Injection via distributionType
- CVE-2026-88888 — Renovate before 44.14.7 Command Injection via Mix organization
- CVE-2026-88886 — Renovate before 44.14.7 Command Injection via gradle-wrapper
- CVE-2026-88885 — Renovate before 44.14.7 Command Injection via depName
- CVE-2026-13745 — Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables
- CVE-2026-88282 — GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection
- CVE-2026-88277 — GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection
- CVE-2026-88276 — GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection