Command Injection Vulnerability in Pheditor by Pheditor

CVE-2026-55578

What is CVE-2026-55578?

Pheditor, a PHP-based file manager, contains a command injection vulnerability due to an incomplete character blocklist in its terminal feature. From versions 2.0.1 to just before 2.0.6, the application fails to adequately sanitize user-supplied commands before executing them via shell_exec(). An authenticated user with the terminal feature can exploit this weakness by using specific characters that bypass the intended restrictions, allowing arbitrary command execution on the web server. Users should upgrade to version 2.0.6 or later to mitigate this security risk.

References