CyberRota Analysis
AI-GeneratedICEcoder versions up to 8.1 are vulnerable due to improper validation of the oldFileName parameter during file move and rename operations, enabling authenticated users to exploit path traversal sequences. This flaw allows attackers to relocate files outside the document root into the web-accessible project directory, potentially leading to unauthorized file disclosure and deletion. Organizations using affected versions should prioritize remediation to mitigate the risk of data exposure and integrity loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.