CVE-2026-48030

Published: Lug 27, 2026 Last Modified: Lug 27, 2026

ExploitDB:

Other exploit source:

Google Dorks:

CRITICAL 9,9

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: changed

Confidentiality: high

Integrity: high

Availability: high

Description

AI Translation Available

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Stable

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Availability Non-Repudiation

Potential Impacts:

Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Read Files Or Directories Modify Files Or Directories Read Application Data Modify Application Data Hide Activities

Applicable Platforms

Technologies: Not Technology-Specific, AI/ML, Web Server

Likelihood of Exploit: High

View CWE Details

https://github.com/pheditor/pheditor/security/advisories/GH…

https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843

https://github.com/pheditor/pheditor/releases/tag/2.0.4