High severity · published Sep 10, 2026
CVE-2026-64837
ICEcoder through 8.1 OS Command Injection via lib/properties.php
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
ICEcoder · ICEcoder
8.0 through 8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64837
github.com
https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md
github.com
https://github.com/icecoder/ICEcoder
github.com
https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/properties.php#L37
www.vulncheck.com
https://www.vulncheck.com/advisories/icecoder-through-8.1-os-command-injection-via-lib-properties-php
More from ICEcoder
9.8
CVE-2026-63722
ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php
8.8
CVE-2026-64836
ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
8.3
CVE-2026-64838
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
7.5
CVE-2022-34026
ICEcoder v8.1 allows attackers to execute a directory traversal
6.3
CVE-2024-41373
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php