Skip to content
OpenAdvisories

Vendor

pheditor

4 known vulnerabilities.

pheditor at a glance

Last 12 months
4
Critical · all time
2
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 4 vulnerabilities, 2 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202642
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

pheditor 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.8
    CVE-2026-55579 Public exploit

    Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on …

    pheditor pheditor pheditor/pheditor Packagist
  • High 8.8
    CVE-2026-55578

    Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After…

    pheditor pheditor pheditor/pheditor Packagist
  • High 8.8
    CVE-2026-54540

    Authenticated terminal command whitelist bypass in Pheditor

    Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMAND…

    pheditor pheditor pheditor/pheditor Packagist
  • Critical 9.9
    CVE-2026-48030 Public exploit

    Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shel…

    pheditor pheditor pheditor/pheditor Packagist