Vulnerability · Published Jul 27, 2026 · Assigned by GitHub_M

CVE-2026-54540Authenticated terminal command whitelist bypass in Pheditor

High 8.8

In plain English

A high-severity OS command injection in pheditor from pheditor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pheditor/pheditor	2.0.5	GHSA-9643-6xjp-vx57

Affected products (as reported)

Vendor	Product	Versions
pheditor	pheditor	< 2.0.5

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57 x_refsource_CONFIRM
https://github.com/pheditor/pheditor/releases/tag/2.0.5 x_refsource_MISC