CVE-2026-54540

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-54540

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-54540

Summary: Pheditor prior to 2.0.5 exposes an authenticated terminal command whitelist bypass. The vulnerability occurs in the terminal feature, which checks if the submitted command starts with a configured value and then passes the full string to shell_exec(). Because shell commands can be execut...

CVE-2026-54540 Authenticated terminal command whitelist bypass in Pheditor

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-48030

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

EUVD-2026-49384

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-48030

Summary: CVE-2026-48030 affects pheditor (PHP) prior to 2.0.4. An OS command injection exists in the terminal action handler by unsafely using the POST parameter and injecting the directory path into shell_exec() without sanitization. This allows an authenticated user with terminal permission to ...

CVE-2026-48030

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-48030 Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-55578: Improper Neutralization of Special Elements used in an OS Command

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

CVE-2026-54540: Improper Neutralization of Special Elements used in an OS Command

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-48030: Improper Neutralization of Special Elements used in an OS Command

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...

CVE-2026-55579: Use of Hard-coded Credentials

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

GHSA-F25V-X6VR-962G Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

GHSA-G3HQ-HPHG-8FHH Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINALCOMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their ow...

PT-2026-67602

Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINAL COMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their o...