# Pheditor authentication bypass in forced password-change flow

Source: https://junglewise.ai/threats/pheditor-authentication-bypass-in-forced-password-change-flow-b0aed4a4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 10 · Published 2026-07-24

Pheditor, a web-based PHP file editor, contains a flaw in its initial setup process that allows anyone to bypass security and take control of the application. If the default password has not been changed, an attacker can reset the administrator password to a value of their choice without knowing the original one. This grants the attacker full access to edit or create files on the server, potentially leading to a complete system takeover.

Technologies: [pheditor/pheditor (Packagist)](https://junglewise.ai/threats/technologies/pheditor-pheditor), [Pheditor](https://junglewise.ai/threats/technologies/pheditor). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pheditor](https://junglewise.ai/threats/vendors/pheditor).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 10, published 24 July 2026.

**Which products and versions are affected?** pheditor/pheditor (Packagist) < 2.0.8; Pheditor < 2.0.8.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-23: Fixed in version 2.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run pheditor/pheditor (Packagist) or Pheditor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass exists in `pheditor.php` due to insufficient validation during the forced password-change flow. When the application detects the default password ('admin') is still set, it enters a branch that checks if the stored password is the default, but fails to verify that the user-provided 'current password' matches that default. An attacker can provide any non-empty value for the current password along with a new password to successfully reconfigure the administrative credentials. This vulnerability allows a remote, unauthenticated attacker to gain full administrative access to the file editor. The issue is fixed in version 2.0.8.

## Affected products

- pheditor pheditor < 2.0.8

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: patched: Fixed in version 2.0.8
- 2026-07-24: advisory

## References

- [https://api.github.com/users/sermikr0](https://api.github.com/users/sermikr0)
- [https://github.com/sermikr0](https://github.com/sermikr0)
- [https://api.github.com/users/sermikr0/gists%7B/gist_id%7D](https://api.github.com/users/sermikr0/gists%7B/gist_id%7D)
- [https://api.github.com/users/sermikr0/repos](https://api.github.com/users/sermikr0/repos)
- [https://avatars.githubusercontent.com/u/230672901?v=4](https://avatars.githubusercontent.com/u/230672901?v=4)
- [https://api.github.com/users/sermikr0/events%7B/privacy%7D](https://api.github.com/users/sermikr0/events%7B/privacy%7D)

## Related threats

- [Pheditor hardcoded default password in pheditor.php](https://junglewise.ai/threats/cve-2026-55579-pheditor-hardcoded-default-password-in-pheditor-php)
- [Pheditor OS command injection in terminal feature](https://junglewise.ai/threats/cve-2026-55578-pheditor-os-command-injection-in-terminal-feature)
- [Pheditor OS command injection via terminal whitelist bypass](https://junglewise.ai/threats/cve-2026-54540-pheditor-os-command-injection-via-terminal-whitelist-bypass)
- [Pheditor OS command injection in terminal handler](https://junglewise.ai/threats/cve-2026-48030-pheditor-os-command-injection-in-terminal-handler)
- [Pheditor RCE via terminal command allowlist bypass](https://junglewise.ai/threats/pheditor-rce-via-terminal-command-allowlist-bypass-3f72f746)