Executive brief
Pheditor, a web-based file management and code editing tool, contains a hardcoded default password that is publicly known. Because the software does not force users to change this password upon first use, attackers can easily gain full administrative control over the application. This allows unauthorized individuals to read sensitive files, upload malicious software, and execute arbitrary commands on the underlying server, potentially leading to a complete system takeover.
Technical details
Pheditor (v2.0.1 to <2.0.6) utilizes a hardcoded SHA-512 hash for the default password 'admin' stored directly in the pheditor.php source file. The application lacks a setup wizard or a forced password change mechanism, meaning many deployments remain accessible via these default credentials. An unauthenticated attacker can use these credentials to access the built-in terminal and file upload features. By combining the default credentials with the application's legitimate administrative functionality, an attacker can achieve arbitrary file read/write and remote code execution (RCE). Version 2.0.6 addresses this by implementing a secure password change mechanism and strengthening command validation.
Affected products
- pheditor Pheditor >= 2.0.1, < 2.0.6
Timeline
- 2026-06-14: patched: Version 2.0.6 released to address the issue.
- 2026-07-27: advisory: CVE-2026-55579 published.