CyberRota Analysis
AI-GeneratedICEcoder versions up to 8.1 are vulnerable to a path traversal flaw that allows authenticated attackers to manipulate the file-control endpoint, bypassing document-root restrictions. This vulnerability enables unauthorized file access, including reading, writing, or deleting files outside the intended directory. Organizations using affected versions should prioritize patching to mitigate potential data breaches and unauthorized file manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.