CVE-2026-54540 Details
Description
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.
An authenticated terminal command whitelist bypass vulnerability has been identified in Pheditor versions prior to 2.0.5. The issue arises because the terminal feature allows users to execute commands via shell_exec() without properly validating the input. Although the application checks if a command starts with an allowed prefix, it fails to block command substitution using the dollar sign and parentheses. As a result, an authenticated user with terminal permissions can bypass restrictions and execute arbitrary commands on the server.
Users can update to Pheditor version 2.0.5, where this vulnerability has been patched. In addition, it is recommended to review and adjust the 'TERMINAL_COMMANDS' allowlist to ensure only safe commands are permitted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pheditor/pheditor/releases/tag/2.0.5 | [email protected] | Release NotesVendor |
| https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pheditor | <= 2.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |