Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

CVE-2026-48030

creationtimestamp| type| source ---|---|--- 2026-05-20 13:11:25+00:00| published-proof-of-concept| https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843 2026-05-28 11:00:13+00:00| seen| Telegram/mMN-AjvGpcaE-zo6q0YmV9Qj204A53PE-cWPysE2p8vKVY 2026-07-27 19:02:05+00:00| seen|...