Is CVE-2026-55578 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55578 being exploited in the wild.

How severe is CVE-2026-55578?

High severity, with a CVSS score of 8.8, published 27 July 2026.

Which products and versions are affected?

pheditor/pheditor (Packagist) >= 2.0.1, = 2.0.1, < 2.0.6.

Is there a fix for CVE-2026-55578?

Yes. pheditor/pheditor (Packagist): upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55578 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55578?

Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55578: Pheditor OS command injection in terminal feature

Q: Is there a fix for CVE-2026-55578?

Yes. pheditor/pheditor (Packagist): upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55578 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55578?

Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55578 · Severity: high · CVSS 8.8 · Published 2026-07-27

Pheditor, a web-based file manager and editor, contains a security flaw in its built-in terminal feature. An authorized user can bypass security restrictions to run unauthorized commands on the underlying server. This could allow an attacker to view sensitive files, modify website data, or take full control of the web server.

Technologies: pheditor/pheditor (Packagist), Pheditor. Vendors: Packagist, Pheditor.

Quick answers

Is CVE-2026-55578 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55578 being exploited in the wild.
How severe is CVE-2026-55578?: High severity, with a CVSS score of 8.8, published 27 July 2026.
Which products and versions are affected?: pheditor/pheditor (Packagist) >= 2.0.1, < 2.0.6, ECOSYSTEM:introduced=2.0.1,fixed=2.0.6; Pheditor >= 2.0.1, < 2.0.6.
Is there a fix for CVE-2026-55578?: Yes. pheditor/pheditor (Packagist): upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55578 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55578?: Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pheditor/pheditor (Packagist): upgrade to 2.0.6 or later
```
composer require pheditor/pheditor:^2.0.6
```

Technical details

The vulnerability is an OS command injection (CWE-78) resulting from incomplete sanitization of user input in the terminal feature. While previous patches blocked characters like '$', the sanitization routine failed to block the pipe (|), backtick (`), and newline (0x0A) characters. Because the terminal validates commands using a prefix-based allowlist check before passing the entire string to shell_exec(), an attacker can append malicious commands using these unblocked metacharacters. For example, a payload like 'ls | id' passes the 'ls' prefix check but executes 'id'. This allows authenticated users with default terminal permissions to achieve remote code execution (RCE) as the web server user. The issue is fixed in version 2.0.6 by hardening the command execution filter.

Affected products

pheditor Pheditor >= 2.0.1, < 2.0.6

Identifiers

CVE-2026-55578
GHSA-wg4w-wr5q-6vjc

Timeline

2026-06-05: disclosed: Initial related bypass GHSA-9643-6xjp-vx57 reported
2026-06-14: patched: Version 2.0.6 released with improved command validation
2026-07-27: advisory: CVE-2026-55578 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.