A path traversal vulnerability in ICEcoder versions 8.0 through 8.1 allows authenticated attackers to perform unauthorized file operations, including disclosure and deletion of sensitive server files.

The application fails to properly validate the oldFileName parameter during file move and rename operations within lib/file-control.php. This allows an authenticated user to leverage path traversal sequences to move files located outside the intended document root into a web-accessible directory, resulting in unauthorized file access or deletion.

Successful exploitation allows an attacker to retrieve sensitive configuration files, source code, or credentials stored on the server, potentially leading to a full system compromise. Furthermore, the ability to delete arbitrary files may cause significant service disruption. With a CVSS score of 8.3, this vulnerability represents a high-risk scenario that requires immediate attention to prevent unauthorized data exposure and potential loss of system integrity.

Immediate Action: Update to the latest version of ICEcoder that addresses this vulnerability, as no specific patch version is currently identified, verify the vendor repository for the most recent stable release.

Proactive Monitoring: Review web server access logs for requests containing path traversal patterns (e.g., ../) directed at the file-control.php endpoint. Monitor for unusual file move or rename activity initiated by standard user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing directory traversal sequences in the oldFileName parameter. Ensure the web server process runs with the least privilege necessary, restricting its ability to read or modify files outside the application root.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for total system impact, this vulnerability poses a significant risk to the confidentiality and availability of your infrastructure. Security teams should prioritize identifying all instances of ICEcoder within the environment and apply the latest vendor updates as soon as they become available. Until an update is applied, restrict access to the ICEcoder interface to trusted networks or implement strict WAF filtering to block malicious payloads.