Quick answers
- Is CVE-2026-64837 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64837 being exploited in the wild.
- How severe is CVE-2026-64837?
- High severity, with a CVSS score of 8.8, published 10 September 2026.
- Which products and versions are affected?
- ICEcoder through 8.1.
- Is there a fix for CVE-2026-64837?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-64837 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-64837?
- Check whether you run ICEcoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
ICEcoder through version 8.1 contains an OS command injection vulnerability in lib/properties.php where an unescaped filesystem path is passed into a shell command via popen(). The vulnerability occurs because user-controllable directory names are concatenated directly into a shell command without proper escaping or sanitization. An authenticated attacker can exploit this by creating directories with embedded shell metacharacters (e.g., backticks, dollar signs, semicolons) in their names. When the Properties function processes these malicious directory names, the shell interprets the metacharacters and executes arbitrary commands as the web server user. No patch is currently available, as the project appears to be abandoned.
Affected products
- ICEcoder ICEcoder through 8.1
Timeline
- 2026-09-10: disclosed
- other: Package marked as abandoned and no longer maintained as of 2023-12-17