Search
Find a vulnerability
Search criteria
8 vulnerabilities found for pheditor by pheditor
CVE-2026-55579 (GCVE-0-2026-55579)
Vulnerability from nvd – Published: 2026-07-27 17:54 – Updated: 2026-07-27 18:59
VLAI
EPSS
VEX
Title
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55579",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:59:14.678268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:59:35.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:54:45.156Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
}
],
"source": {
"advisory": "GHSA-p4h7-p9rj-2pq2",
"discovery": "UNKNOWN"
},
"title": "Pheditor: Hardcoded default password \u0027admin\u0027 with no forced change enables full application compromise"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55579",
"datePublished": "2026-07-27T17:54:45.156Z",
"dateReserved": "2026-06-16T23:18:03.169Z",
"dateUpdated": "2026-07-27T18:59:35.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55578 (GCVE-0-2026-55578)
Vulnerability from nvd – Published: 2026-07-27 17:54 – Updated: 2026-07-27 17:54
VLAI
EPSS
VEX
Title
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.
Severity
8.8 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/advisories/GHSA-9643-6xjp-vx57 | x_refsource_MISC |
| https://github.com/pheditor/pheditor/releases/tag/2.0.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:54:29.407Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc"
},
{
"name": "https://github.com/advisories/GHSA-9643-6xjp-vx57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-9643-6xjp-vx57"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
}
],
"source": {
"advisory": "GHSA-wg4w-wr5q-6vjc",
"discovery": "UNKNOWN"
},
"title": "Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55578",
"datePublished": "2026-07-27T17:54:29.407Z",
"dateReserved": "2026-06-16T23:18:03.169Z",
"dateUpdated": "2026-07-27T17:54:29.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54540 (GCVE-0-2026-54540)
Vulnerability from nvd – Published: 2026-07-27 17:53 – Updated: 2026-07-27 18:36
VLAI
EPSS
VEX
Title
Authenticated terminal command whitelist bypass in Pheditor
Summary
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54540",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:36:21.340913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:36:26.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:53:53.891Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.5"
}
],
"source": {
"advisory": "GHSA-9643-6xjp-vx57",
"discovery": "UNKNOWN"
},
"title": "Authenticated terminal command whitelist bypass in Pheditor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54540",
"datePublished": "2026-07-27T17:53:53.891Z",
"dateReserved": "2026-06-15T19:04:14.455Z",
"dateUpdated": "2026-07-27T18:36:26.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48030 (GCVE-0-2026-48030)
Vulnerability from nvd – Published: 2026-07-27 17:53 – Updated: 2026-07-27 18:53
VLAI
EPSS
VEX
Title
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48030",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:53:32.014022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:53:42.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the \u0027dir\u0027 POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:53:34.438Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4"
}
],
"source": {
"advisory": "GHSA-jvc5-6g7q-c843",
"discovery": "UNKNOWN"
},
"title": "Pheditor: OS Command Injection in terminal handler via unsanitized \u0027dir\u0027 parameter (CWE-78)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48030",
"datePublished": "2026-07-27T17:53:34.438Z",
"dateReserved": "2026-05-20T17:44:09.588Z",
"dateUpdated": "2026-07-27T18:53:42.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55579 (GCVE-0-2026-55579)
Vulnerability from cvelistv5 – Published: 2026-07-27 17:54 – Updated: 2026-07-27 18:59
VLAI
EPSS
VEX
Title
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55579",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:59:14.678268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:59:35.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:54:45.156Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
}
],
"source": {
"advisory": "GHSA-p4h7-p9rj-2pq2",
"discovery": "UNKNOWN"
},
"title": "Pheditor: Hardcoded default password \u0027admin\u0027 with no forced change enables full application compromise"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55579",
"datePublished": "2026-07-27T17:54:45.156Z",
"dateReserved": "2026-06-16T23:18:03.169Z",
"dateUpdated": "2026-07-27T18:59:35.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55578 (GCVE-0-2026-55578)
Vulnerability from cvelistv5 – Published: 2026-07-27 17:54 – Updated: 2026-07-27 17:54
VLAI
EPSS
VEX
Title
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.
Severity
8.8 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/advisories/GHSA-9643-6xjp-vx57 | x_refsource_MISC |
| https://github.com/pheditor/pheditor/releases/tag/2.0.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:54:29.407Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc"
},
{
"name": "https://github.com/advisories/GHSA-9643-6xjp-vx57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-9643-6xjp-vx57"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
}
],
"source": {
"advisory": "GHSA-wg4w-wr5q-6vjc",
"discovery": "UNKNOWN"
},
"title": "Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55578",
"datePublished": "2026-07-27T17:54:29.407Z",
"dateReserved": "2026-06-16T23:18:03.169Z",
"dateUpdated": "2026-07-27T17:54:29.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54540 (GCVE-0-2026-54540)
Vulnerability from cvelistv5 – Published: 2026-07-27 17:53 – Updated: 2026-07-27 18:36
VLAI
EPSS
VEX
Title
Authenticated terminal command whitelist bypass in Pheditor
Summary
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54540",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:36:21.340913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:36:26.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:53:53.891Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.5"
}
],
"source": {
"advisory": "GHSA-9643-6xjp-vx57",
"discovery": "UNKNOWN"
},
"title": "Authenticated terminal command whitelist bypass in Pheditor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54540",
"datePublished": "2026-07-27T17:53:53.891Z",
"dateReserved": "2026-06-15T19:04:14.455Z",
"dateUpdated": "2026-07-27T18:36:26.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48030 (GCVE-0-2026-48030)
Vulnerability from cvelistv5 – Published: 2026-07-27 17:53 – Updated: 2026-07-27 18:53
VLAI
EPSS
VEX
Title
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
Summary
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pheditor/pheditor/security/adv… | x_refsource_CONFIRM |
| https://github.com/pheditor/pheditor/releases/tag/2.0.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48030",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T18:53:32.014022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:53:42.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pheditor",
"vendor": "pheditor",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.1, \u003c 2.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the \u0027dir\u0027 POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:53:34.438Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"
},
{
"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4"
}
],
"source": {
"advisory": "GHSA-jvc5-6g7q-c843",
"discovery": "UNKNOWN"
},
"title": "Pheditor: OS Command Injection in terminal handler via unsanitized \u0027dir\u0027 parameter (CWE-78)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48030",
"datePublished": "2026-07-27T17:53:34.438Z",
"dateReserved": "2026-05-20T17:44:09.588Z",
"dateUpdated": "2026-07-27T18:53:42.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}