CVE-2026-48030
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
Risk Assessment
The risk includes full remote code execution with web server privileges, potentially leading to complete system compromise.
Recommendation
Update Pheditor to version 2.0.4 or later, which contains the fix.
Original NVD description (English source)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.