CVE-2026-55578 Details
Description
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.
A command injection vulnerability has been identified in Pheditor, a PHP-based single-file editor and file manager, affecting versions 2.0.1 prior to 2.0.6. The issue arises in the terminal feature, which fails to adequately sanitize user-supplied commands before executing them with shell_exec(). Although the recent update in version 2.0.6 improved command validation by blocking additional unsafe characters, the terminal feature still allows for arbitrary command execution by exploiting the command substitution syntax or by injecting newline characters. This vulnerability impacts authenticated users with terminal permissions, which are enabled by default, allowing them to bypass the designated command allowlist and execute commands as the web server user.
Users are advised to update Pheditor to version 2.0.6, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc | CISA-ADP | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
| https://github.com/advisories/GHSA-9643-6xjp-vx57 | [email protected] | AdvisoryBundleRemedy |
| https://github.com/pheditor/pheditor/releases/tag/2.0.6 | [email protected] | Release NotesVendor |
| https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc | [email protected] | AdvisoryBundleExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pheditor | <= 2.0.4 (semver) >= 2.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |