Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 10, published 24 July 2026.

Which products and versions are affected?

pheditor/pheditor (Packagist) < 2.0.8; Pheditor < 2.0.8.

Is there a fix for This vulnerability?

A patch was published on 2026-07-23: Fixed in version 2.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Pheditor authentication bypass in forced password-change flow

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-23: Fixed in version 2.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 10 · Published 2026-07-24

Pheditor, a web-based PHP file editor, contains a flaw in its initial setup process that allows anyone to bypass security and take control of the application. If the default password has not been changed, an attacker can reset the administrator password to a value of their choice without knowing the original one. This grants the attacker full access to edit or create files on the server, potentially leading to a complete system takeover.

Technologies: pheditor/pheditor (Packagist), Pheditor. Vendors: Packagist, Pheditor.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 10, published 24 July 2026.
Which products and versions are affected?: pheditor/pheditor (Packagist) < 2.0.8; Pheditor < 2.0.8.
Is there a fix for This vulnerability?: A patch was published on 2026-07-23: Fixed in version 2.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in `pheditor.php` due to insufficient validation during the forced password-change flow. When the application detects the default password ('admin') is still set, it enters a branch that checks if the stored password is the default, but fails to verify that the user-provided 'current password' matches that default. An attacker can provide any non-empty value for the current password along with a new password to successfully reconfigure the administrative credentials. This vulnerability allows a remote, unauthenticated attacker to gain full administrative access to the file editor. The issue is fixed in version 2.0.8.

Affected products

pheditor pheditor < 2.0.8

Timeline

2026-07-23: disclosed
2026-07-23: patched: Fixed in version 2.0.8
2026-07-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.