CVE-2026-48030criticalCWE-78

CVE-2026-48030: fallo crítico en pheditor

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Publicada el

Seguir esta CVE+ Monitorear pheditor+ Monitorear pheditor/pheditor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

63Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 9.9epss 7.5%
de la publicación al armael mismo día
Publicada en NVD27 jul
1ª PoC28 may
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
pheditor · pheditor
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — pheditor

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-55579CRITICALPheditor: Hardcoded default password 'admin' with no forced change enables full application compromiseEPSS 0.8%CVE-2026-54540HIGHAuthenticated terminal command whitelist bypass in PheditorEPSS 0.7%CVE-2026-55578HIGHPheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injectionEPSS 0.7%