CVE-2026-63722: ICEcoder 8.1 RCE Vulnerability

CVE-2026-63722 Overview

CVE-2026-63722 is an unauthenticated remote code execution vulnerability in ICEcoder 8.1, a browser-based code editor written in PHP. The flaw resides in the terminal XHR endpoint, which chains three defects: an authentication bypass, a CSRF validation bypass, and unsanitized command execution through proc_open(). Attackers can send a single HTTP POST request containing a password parameter, a non-empty csrf parameter, and an arbitrary command string to execute operating system commands as the web-server user. The weakness is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
A single unauthenticated HTTP POST request grants arbitrary command execution as the web-server user, enabling full compromise of the hosting environment.

Affected Products

ICEcoder 8.1
ICEcoder browser-based PHP code editor
Web servers hosting the vulnerable terminal-xhr.php endpoint

Discovery Timeline

2026-08-19 - CVE-2026-63722 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-63722

Vulnerability Analysis

The vulnerability exists in the terminal XHR PHP handler within ICEcoder 8.1. The endpoint accepts a POST request that is expected to be authenticated and CSRF-protected, but both controls can be bypassed by supplying attacker-controlled parameters. Once the checks are skipped, the command parameter is passed directly to PHP's proc_open() function without sanitization or allow-listing.

An attacker only needs network reachability to the ICEcoder web interface. Because the endpoint executes shell commands under the web-server account, successful exploitation yields file system read and write access, credential theft from configuration files, lateral pivoting, and persistence via web shells. The EPSS score of 0.985% reflects publicly available proof-of-concept code that reduces the effort required to weaponize the flaw.

Root Cause

The root cause is the combination of missing authentication enforcement and improper trust in client-supplied CSRF state. The handler treats the mere presence of a password parameter as evidence of a valid session and treats any non-empty csrf value as a passed CSRF check. Neither value is compared against a server-side secret. The command string is then forwarded to proc_open() with no filtering.

Attack Vector

Exploitation requires a network-reachable ICEcoder 8.1 instance. The attacker crafts a single HTTP POST request to the terminal endpoint with three fields: an arbitrary password value, an arbitrary non-empty csrf value, and a cmd parameter containing the operating system command. The server executes the command in the context of the PHP process user, returning output in the HTTP response.

Proof-of-concept code is published in a GitHub Gist PoC and technical details are documented in the VulnCheck Advisory on ICEcoder RCE.

Detection Methods for CVE-2026-63722

Indicators of Compromise

HTTP POST requests to terminal-xhr.php containing both password and csrf parameters from unauthenticated sources
New child processes spawned by the PHP-FPM or Apache worker such as sh, bash, curl, wget, or python
Unexpected outbound network connections initiated by the web-server user shortly after POST requests to the terminal endpoint
Creation of files with executable extensions in ICEcoder web-accessible directories

Detection Strategies

Alert on any request to terminal-xhr.php that originates from an IP address without an established authenticated session
Correlate web server access logs with process creation telemetry to link inbound HTTP requests to shell command execution
Inspect request bodies for the co-occurrence of password, csrf, and command-shell metacharacters such as ;, |, or &&

Monitoring Recommendations

Enable verbose access logging on the ICEcoder virtual host and forward logs to a central SIEM for retention and correlation
Monitor process ancestry on hosts running ICEcoder to detect web-server processes launching interactive shells or interpreters
Track file integrity in the ICEcoder installation directory and in typical web-shell drop locations

How to Mitigate CVE-2026-63722

Immediate Actions Required

Remove or restrict network access to terminal-xhr.php until an upstream fix is applied
Place ICEcoder behind an authenticated reverse proxy or VPN so the terminal endpoint is not reachable from untrusted networks
Audit web-server process trees and file systems for signs of prior exploitation, including unexpected cron jobs and new PHP files
Rotate credentials, API keys, and tokens stored on any host that ran a vulnerable ICEcoder instance

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of publication. Consult the ICEcoder GitHub repository for updated releases and the VulnCheck Advisory on ICEcoder RCE for the current remediation guidance.

Workarounds

Block requests to the terminal XHR endpoint at the web server or WAF layer using URL path filtering
Enforce IP allow-listing on the ICEcoder application so only trusted administrative networks can reach the interface
Run the PHP worker under a least-privileged user account with no shell and no write access to sensitive directories
Disable dangerous PHP functions such as proc_open, exec, shell_exec, and passthru in php.ini where operationally feasible

bash

# Configuration example: block the vulnerable endpoint at the web server
# Apache httpd example
<Location "/terminal-xhr.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Nginx equivalent
location = /terminal-xhr.php {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

# Disable dangerous PHP functions in php.ini
disable_functions = proc_open,exec,shell_exec,passthru,system,popen