Executive brief
ICEcoder is a browser-based code editor that allows developers to write and manage website code through a web interface. The vulnerability allows authenticated users to move files from anywhere on the server into the web-accessible project directory, potentially exposing sensitive files and deleting originals from their intended locations.
Technical details
This is a path traversal vulnerability (CWE-22) in the file move and rename operations. The vulnerable component fails to properly validate the oldFileName parameter, allowing attackers to use path traversal sequences (e.g., ../) to reference and move files outside the intended document root. The attack requires authentication to access the ICEcoder interface. An authenticated attacker can exploit this to relocate any files writable by the PHP process into the web directory, enabling file disclosure and data deletion. The vulnerability affects ICEcoder through version 8.1.
Affected products
- ICEcoder ICEcoder through 8.1
Timeline
- 2026-09-10: disclosed