# CVE-2026-55578: Pheditor OS command injection in terminal feature

Source: https://junglewise.ai/threats/cve-2026-55578-pheditor-os-command-injection-in-terminal-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-55578 · Severity: high · CVSS 8.8 · Published 2026-07-27

Pheditor, a web-based file manager and editor, contains a security flaw in its built-in terminal feature. An authorized user can bypass security restrictions to run unauthorized commands on the underlying server. This could allow an attacker to view sensitive files, modify website data, or take full control of the web server.

Technologies: [pheditor/pheditor (Packagist)](https://junglewise.ai/threats/technologies/pheditor-pheditor), [Pheditor](https://junglewise.ai/threats/technologies/pheditor). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pheditor](https://junglewise.ai/threats/vendors/pheditor).

## Quick answers

**Is CVE-2026-55578 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55578 being exploited in the wild.

**How severe is CVE-2026-55578?** High severity, with a CVSS score of 8.8, published 27 July 2026.

**Which products and versions are affected?** pheditor/pheditor (Packagist) >= 2.0.1, < 2.0.6, ECOSYSTEM:introduced=2.0.1,fixed=2.0.6; Pheditor >= 2.0.1, < 2.0.6.

**Is there a fix for CVE-2026-55578?** Yes. pheditor/pheditor (Packagist): upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55578 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55578?** Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pheditor/pheditor (Packagist): upgrade to 2.0.6 or later

  ```sh
  composer require pheditor/pheditor:^2.0.6
  ```


## Technical details

The vulnerability is an OS command injection (CWE-78) resulting from incomplete sanitization of user input in the terminal feature. While previous patches blocked characters like '$', the sanitization routine failed to block the pipe (|), backtick (`), and newline (0x0A) characters. Because the terminal validates commands using a prefix-based allowlist check before passing the entire string to shell_exec(), an attacker can append malicious commands using these unblocked metacharacters. For example, a payload like 'ls | id' passes the 'ls' prefix check but executes 'id'. This allows authenticated users with default terminal permissions to achieve remote code execution (RCE) as the web server user. The issue is fixed in version 2.0.6 by hardening the command execution filter.

## Affected products

- pheditor Pheditor >= 2.0.1, < 2.0.6

## Identifiers

- CVE-2026-55578
- GHSA-wg4w-wr5q-6vjc

## Timeline

- 2026-06-05: disclosed: Initial related bypass GHSA-9643-6xjp-vx57 reported
- 2026-06-14: patched: Version 2.0.6 released with improved command validation
- 2026-07-27: advisory: CVE-2026-55578 published

## References

- [https://github.com/pheditor/pheditor/releases/tag/2.0.6](https://github.com/pheditor/pheditor/releases/tag/2.0.6)
- [https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc](https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc)

## Related threats

- [Pheditor hardcoded default password in pheditor.php](https://junglewise.ai/threats/cve-2026-55579-pheditor-hardcoded-default-password-in-pheditor-php)
- [Pheditor OS command injection via terminal whitelist bypass](https://junglewise.ai/threats/cve-2026-54540-pheditor-os-command-injection-via-terminal-whitelist-bypass)
- [Pheditor OS command injection in terminal handler](https://junglewise.ai/threats/cve-2026-48030-pheditor-os-command-injection-in-terminal-handler)
- [Pheditor authentication bypass in forced password-change flow](https://junglewise.ai/threats/pheditor-authentication-bypass-in-forced-password-change-flow-b0aed4a4)
- [Pheditor RCE via terminal command allowlist bypass](https://junglewise.ai/threats/pheditor-rce-via-terminal-command-allowlist-bypass-3f72f746)