CVE-2026-54540
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Pheditor before version 2.0.5 has a vulnerability in the terminal feature that only checks the start of the command and does not block shell command substitution ($()). Authenticated users can bypass the command allowlist and execute arbitrary OS commands.
Risk Assessment
An attacker can execute arbitrary commands on the server as the www-data user, leading to full server compromise.
Recommendation
Update Pheditor to version 2.0.5 or later.
Other vulnerabilities in Pheditor
See all- CVE-2026-66824Critical
A stored XSS vulnerability in the capture tree visualization tool. Serialized tree data was embedded in an inline JavaScript block, allowing injection of malicious HTML/JavaScript. An attacker could perform actions in the victim's session context.
- CVE-2026-55579Critical
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
- CVE-2026-48030Critical
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
- CVE-2026-55578High
Pheditor versions 2.0.1-2.0.5 have a vulnerability in the terminal feature with an incomplete character blocklist. Characters |, `, and newline (0x0A) are not blocked, allowing authenticated users to bypass the command allowlist and execute arbitrary OS commands.
Original NVD description (English source)
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.