Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-55579 EUVD-2026-49387GHSA-p4h7-p9rj-2pq2

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Published Jul 27, 2026 · Updated Jul 27, 2026 · Assigned by GitHub_M

Vendor: pheditor Product: pheditor Package: pheditor/pheditor Ecosystem: Packagist

Description

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.

Affected products

VendorProductAffectedFixed
pheditor pheditor >= 2.0.1, < 2.0.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Ch4120N/CVE-2026-55579 ★ 1 · Jul 17, 2026

    CVE-2026-55579 – Unauthenticated RCE in Pheditor via hardcoded default password "admin". Full Python exploit with file upload & terminal execution. No dependencies.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist pheditor/pheditor >= 2.0.1, < 2.0.6 2.0.6 GHSA-p4h7-p9rj-2pq2

References