CVE-2026-63722

Name of the Vulnerable Software and Affected Versions ICEcoder version 8.1

Description An unauthenticated remote code execution issue allows attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF (Cross-Site Request Forgery) validation bypass, and unsanitized command execution. An attacker can send a single HTTP POST request to the terminal endpoint using a password parameter to bypass authentication and a non-empty csrf parameter to skip CSRF validation. This allows an arbitrary command string to be passed directly to the proc open() function, resulting in remote code execution with the privileges of the web-server user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.