CVE-2026-48030

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/pheditor/pheditor/releases/tag/2.0.4
https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843
https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Pheditor es un editor de un solo archivo y gestor de archivos escrito en PHP. Desde la versión 2.0.1 hasta antes de la versión 2.0.4, una vulnerabilidad de inyección de comandos del sistema operativo en el gestor de acciones de la terminal permite a cualquier usuario autenticado ejecutar comandos arbitrarios del sistema operativo inyectando metacaracteres de shell en el parámetro POST ’dir’, eludiendo completamente la lista blanca TERMINAL_COMMANDS y logrando la ejecución remota de código completa con privilegios de servidor web. Este problema ha sido parcheado en la versión 2.0.4.

Information

Published : 2026-07-27 18:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-48030

Mitre link : CVE-2026-48030

CVE.ORG link : CVE-2026-48030

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-48030", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48030", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T18:53:32.014022Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pheditor", "product": "pheditor", "versions": [{"status": "affected", "version": ">= 2.0.1, < 2.0.4"}]}]}], "published": "2026-07-27T18:16:55.347", "references": [{"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "source": "security-advisories@github.com"}, {"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."}, {"lang": "es", "value": "Pheditor es un editor de un solo archivo y gestor de archivos escrito en PHP. Desde la versi\u00f3n 2.0.1 hasta antes de la versi\u00f3n 2.0.4, una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el gestor de acciones de la terminal permite a cualquier usuario autenticado ejecutar comandos arbitrarios del sistema operativo inyectando metacaracteres de shell en el par\u00e1metro POST \u2019dir\u2019, eludiendo completamente la lista blanca TERMINAL_COMMANDS y logrando la ejecuci\u00f3n remota de c\u00f3digo completa con privilegios de servidor web. Este problema ha sido parcheado en la versi\u00f3n 2.0.4."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "security-advisories@github.com"}