Pheditor vulnerabilities
5 known CVE vulnerabilities in Pheditor, translated and rated.
- CVE-2026-66824Critical
A stored XSS vulnerability in the capture tree visualization tool. Serialized tree data was embedded in an inline JavaScript block, allowing injection of malicious HTML/JavaScript. An attacker could perform actions in the victim's session context.
- CVE-2026-55579Critical
Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash). No mechanism forces a password change on first login. Any deployment using default credentials grants full access to file editor, upload, and terminal, enabling arbitrary file read/write and remote code execution.
- CVE-2026-48030Critical
An OS Command Injection vulnerability in Pheditor allows an authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist.
- CVE-2026-55578High
Pheditor versions 2.0.1-2.0.5 have a vulnerability in the terminal feature with an incomplete character blocklist. Characters |, `, and newline (0x0A) are not blocked, allowing authenticated users to bypass the command allowlist and execute arbitrary OS commands.
- CVE-2026-54540High
Pheditor before version 2.0.5 has a vulnerability in the terminal feature that only checks the start of the command and does not block shell command substitution ($()). Authenticated users can bypass the command allowlist and execute arbitrary OS commands.