CVE-2026-48030
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
Risk Assessment
The risk includes full remote code execution with web server privileges, potentially leading to complete system compromise.
Recommendation
Update Pheditor to version 2.0.4 or later, which contains the fix.
Other vulnerabilities in Pheditor
See all- CVE-2026-66824Critical
A stored XSS vulnerability in the capture tree visualization tool. Serialized tree data was embedded in an inline JavaScript block, allowing injection of malicious HTML/JavaScript. An attacker could perform actions in the victim's session context.
- CVE-2026-55579Critical
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
- CVE-2026-55578High
Pheditor versions 2.0.1-2.0.5 have a vulnerability in the terminal feature with an incomplete character blocklist. Characters |, `, and newline (0x0A) are not blocked, allowing authenticated users to bypass the command allowlist and execute arbitrary OS commands.
- CVE-2026-54540High
Pheditor before version 2.0.5 has a vulnerability in the terminal feature that only checks the start of the command and does not block shell command substitution ($()). Authenticated users can bypass the command allowlist and execute arbitrary OS commands.
Original NVD description (English source)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.