Remote Code Execution Vulnerability in ICEcoder from Author ICcoder

CVE-2026-63722

What is CVE-2026-63722?

ICEcoder version 8.1 is susceptible to a remote code execution vulnerability that allows attackers to execute arbitrary operating system commands. This exploitation occurs through a series of bypasses. Attackers can exploit this vulnerability by sending a single malicious HTTP POST request to the terminal endpoint. The request can include a password parameter to evade authentication, along with a non-empty CSRF parameter to skip CSRF validation. Finally, the arbitrary command string passed directly to proc_open() can result in successful remote code execution under the privileges of the web server user, leading to significant security risks.

References