CVE-2026-55578: Pheditor OS command injection in terminal feature

Executive brief

Pheditor, a web-based file manager and editor, contains a security flaw in its built-in terminal feature. An authorized user can bypass security restrictions to run unauthorized commands on the underlying server. This could allow an attacker to view sensitive files, modify website data, or take full control of the web server.

Technical details

The vulnerability is an OS command injection (CWE-78) resulting from incomplete sanitization of user input in the terminal feature. While previous patches blocked characters like ' , the sanitization routine failed to block the pipe (|), backtick (`), and newline (0x0A) characters. Because the terminal validates commands using a prefix-based allowlist check before passing the entire string to shell_exec(), an attacker can append malicious commands using these unblocked metacharacters. For example, a payload like 'ls | id' passes the 'ls' prefix check but executes 'id'. This allows authenticated users with default terminal permissions to achieve remote code execution (RCE) as the web server user. The issue is fixed in version 2.0.6 by hardening the command execution filter.

Affected products

• pheditor Pheditor >= 2.0.1, < 2.0.6

Timeline

• 2026-06-05: disclosed: Initial related bypass GHSA-9643-6xjp-vx57 reported
• 2026-06-14: patched: Version 2.0.6 released with improved command validation
• 2026-07-27: advisory: CVE-2026-55578 published

References

• https://github.com/pheditor/pheditor/releases/tag/2.0.6
• https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc