# CVE-2026-64837: ICEcoder OS command injection in lib/properties.php

Source: https://junglewise.ai/threats/cve-2026-64837-icecoder-os-command-injection-in-lib-properties-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-64837 · Severity: high · CVSS 8.8 · Published 2026-09-10

ICEcoder is a browser-based code editor that allows developers to write and maintain websites from any browser. An authenticated attacker can inject arbitrary operating system commands by creating directories with shell metacharacters in their names and accessing the Properties function, leading to command execution with the privileges of the web server process and potential full system compromise.

Technologies: [ICEcoder](https://junglewise.ai/threats/technologies/icecoder). Vendors: [ICEcoder](https://junglewise.ai/threats/vendors/icecoder).

## Quick answers

**Is CVE-2026-64837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64837 being exploited in the wild.

**How severe is CVE-2026-64837?** High severity, with a CVSS score of 8.8, published 10 September 2026.

**Which products and versions are affected?** ICEcoder through 8.1.

**Is there a fix for CVE-2026-64837?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-64837 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-64837?** Check whether you run ICEcoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ICEcoder through version 8.1 contains an OS command injection vulnerability in lib/properties.php where an unescaped filesystem path is passed into a shell command via popen(). The vulnerability occurs because user-controllable directory names are concatenated directly into a shell command without proper escaping or sanitization. An authenticated attacker can exploit this by creating directories with embedded shell metacharacters (e.g., backticks, dollar signs, semicolons) in their names. When the Properties function processes these malicious directory names, the shell interprets the metacharacters and executes arbitrary commands as the web server user. No patch is currently available, as the project appears to be abandoned.

## Affected products

- ICEcoder ICEcoder through 8.1

## Timeline

- 2026-09-10: disclosed
- other: Package marked as abandoned and no longer maintained as of 2023-12-17

## References

- [https://packagist.org/packages/icecoder/icecoder](https://packagist.org/packages/icecoder/icecoder)
- [https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md](https://github.com/Caycon/cve-advisories/blob/main/2026/ICEcoder/CVE-2026-64837.md)

## Related threats

- [ICEcoder path traversal in file move and rename](https://junglewise.ai/threats/cve-2026-64838-icecoder-path-traversal-in-file-move-and-rename)
- [ICEcoder path traversal in file-control endpoint](https://junglewise.ai/threats/cve-2026-64836-icecoder-path-traversal-in-file-control-endpoint)