Skip to content
OpenAdvisories

Vendor

pheditor

4 known vulnerabilities.

Products

pheditor 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55578

    Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After…

    pheditor pheditor pheditor/pheditor Packagist
  • High 8.8
    CVE-2026-54540

    Authenticated terminal command whitelist bypass in Pheditor

    Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMAND…

    pheditor pheditor pheditor/pheditor Packagist