High severity · published Sep 10, 2026
CVE-2026-64838
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
ICEcoder · ICEcoder
8.0 through 8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64838
github.com
https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64838.md
github.com
https://github.com/icecoder/ICEcoder
github.com
https://github.com/icecoder/ICEcoder/blob/4a61847ef7bb0360735cf1d55c45e5de9746e24e/lib/file-control.php#L198
www.vulncheck.com
https://www.vulncheck.com/advisories/icecoder-through-8.1-path-traversal-via-oldfilename-parameter
More from ICEcoder
9.8
CVE-2026-63722
ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php
8.8
CVE-2026-64837
ICEcoder through 8.1 OS Command Injection via lib/properties.php
8.8
CVE-2026-64836
ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
7.5
CVE-2022-34026
ICEcoder v8.1 allows attackers to execute a directory traversal
6.3
CVE-2024-41373
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php