CVE-2026-48030criticalCWE-78

CVE-2026-48030: critical vulnerability in pheditor

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Published

Follow this CVE+ Monitor pheditor+ Monitor pheditor/pheditor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.9epss 7.5%
from disclosure to weaponsame day
Published on NVDJul 27
1st PoCMay 28
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
pheditor · pheditor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — pheditor

In the same product, most dangerous first.

CVE-2026-55579CRITICALPheditor: Hardcoded default password 'admin' with no forced change enables full application compromiseEPSS 0.8%CVE-2026-54540HIGHAuthenticated terminal command whitelist bypass in PheditorEPSS 0.7%CVE-2026-55578HIGHPheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injectionEPSS 0.7%