Skip to content
OpenAdvisories

Package · Packagist

pheditor/pheditor

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55578

    Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After…

    pheditor pheditor pheditor/pheditor Packagist
  • High 8.8
    CVE-2026-54540

    Authenticated terminal command whitelist bypass in Pheditor

    Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMAND…

    pheditor pheditor pheditor/pheditor Packagist
  • High 8.8
    GHSA-g3hq-hphg-8fhh

    Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

    ### Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that gra…

    pheditor/pheditor Packagist