CVE-2026-55578
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Pheditor versions 2.0.1-2.0.5 have a vulnerability in the terminal feature with an incomplete character blocklist. Characters |, `, and newline (0x0A) are not blocked, allowing authenticated users to bypass the command allowlist and execute arbitrary OS commands.
Risk Assessment
An attacker can execute arbitrary commands on the server as the www-data user, leading to full server compromise.
Recommendation
Update Pheditor to version 2.0.6.
Other vulnerabilities in Pheditor
See all- CVE-2026-66824Critical
A stored XSS vulnerability in the capture tree visualization tool. Serialized tree data was embedded in an inline JavaScript block, allowing injection of malicious HTML/JavaScript. An attacker could perform actions in the victim's session context.
- CVE-2026-55579Critical
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
- CVE-2026-48030Critical
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
- CVE-2026-54540High
Pheditor before version 2.0.5 has a vulnerability in the terminal feature that only checks the start of the command and does not block shell command substitution ($()). Authenticated users can bypass the command allowlist and execute arbitrary OS commands.
Original NVD description (English source)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.