{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pheditor/pheditor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:45:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\npheditor\u0027s terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their own options (`find`, `git`, `php`, `tar`, `grep`). A caller can therefore run any command using only allowlisted binaries and no rejected metacharacter, escaping the allowlist restriction the terminal feature relies on.\n\n### Relationship to the prior terminal advisories (this is a surviving, distinct vector)\n\nThe prior terminal advisories were all shell-metacharacter injections: GHSA-9643-6xjp-vx57 (`$()`), GHSA-wg4w-wr5q-6vjc (`|`, backtick, newline), GHSA-jvc5-58fv-w8cq (`;` via the dir field). The current code rejects those characters. This report is a different class \u2014 CWE-88 argument injection through an allowlisted binary\u0027s flags \u2014 which the metacharacter denylist does not address.\n\n### Root cause (HEAD, v2.0.6)\n\nIn the `terminal` action handler of `pheditor.php`:\n1. `:588` rejects `\u0026`, `;`, `|`, `$`, backtick, `\\n`, `\\r`. It does NOT reject space, `-`, `{`, `}`, `+`, `/`, `.`.\n2. `:595-605` checks the command against `TERMINAL_COMMANDS` (defined `:25`: `ls,...,php,...,git,find,grep,...,tar,...,composer,exit`) using a PREFIX match: `strlen($command) \u003e= strlen($value) \u0026\u0026 substr($command, 0, strlen($value)) == $value`. There is no word boundary and no validation of the arguments that follow.\n3. `:617` runs the command through the shell unchanged: `shell_exec((empty($dir) ? null : \u0027cd \u0027 . escapeshellarg($dir) . \u0027 \u0026\u0026 \u0027) . $command . \u0027 \u0026\u0026 echo \\ ; pwd\u0027)`.\n\nSo a command beginning with an allowlisted binary, carrying a code-exec flag, and containing none of the rejected characters reaches `shell_exec` intact.\n\n### Proof of concept (reproduced)\n\nPOST to the terminal action with:\n  command = `find . -maxdepth 0 -exec touch /tmp/PWNED {} +`\n  dir = (any)\n\nThis contains no rejected metacharacter, prefix-matches the allowlisted `find`, and `find -exec` runs an arbitrary program. A faithful harness mirroring the three guards (`poc/reproduction.sh`, `poc/transcript.txt`) creates the marker file. Other allowlisted-binary payloads with the same property: `git -c alias.x=\u0027!touch /tmp/PWNED\u0027 x`, `php -r \u0027system(\"id\");\u0027`, `tar -cf /dev/null --checkpoint=1 --checkpoint-action=exec=\"touch /tmp/PWNED\" .`.\n\n### Impact\n\nArbitrary command execution on the host, under the web server\u0027s privileges, for a caller with the `terminal` permission (enabled in the default configuration). The exposure is amplified by GHSA-p4h7-p9rj-2pq2 (hardcoded default `admin` password with no forced change): a default deployment grants the authenticated access needed to reach the terminal action with a single known credential, making the chain effectively unauthenticated RCE.\n\n### Remediation\n\nValidate the FULL command, not just its prefix: tokenize and require the program to be an allowlisted binary AND constrain its arguments (reject `-exec`/`-execdir` for `find`, `-c`/`--upload-pack` for `git`, `-r`/`-d` for `php`, `--checkpoint-action`/`--to-command` for `tar`, `-f`/`--file` program forms, etc.), or run each command as an argv array through a restricted launcher with no shell, or remove the code-exec-capable binaries from the allowlist. A prefix allowlist over a shell sink cannot constrain capability.\n\nCredit: anir0y (independent security research).",
  "id": "GHSA-g3hq-hphg-8fhh",
  "modified": "2026-07-24T21:45:40Z",
  "published": "2026-07-24T21:45:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-g3hq-hphg-8fhh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/commit/f40f5070d5a171b65359bc87568734d31de498e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pheditor/pheditor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE \u2014 surviving vector after the metacharacter-sanitization fixes"
}