CVE-2026-55579
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
Risk Assessment
The risk is critical – unchanged default password allows immediate takeover of the application and server.
Recommendation
Immediately change the default password to a strong, unique one and update Pheditor to version 2.0.6 or later.
Original NVD description (English source)
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.