{"id":"CVE-2026-55578","published":"2026-07-27T17:54:29Z","modified":"2026-07-28T14:03:57Z","title":"Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and…","vendor":"pheditor","product":"pheditor","tier":"tail","description":{"text":"Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00667,"percentile":0.51729,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/advisories/GHSA-9643-6xjp-vx57","tags":["x_refsource_MISC"]},{"url":"https://github.com/pheditor/pheditor/releases/tag/2.0.6","tags":["x_refsource_MISC"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":10.35},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"pheditor","affectedVersions":[{"vendor":"pheditor","product":"pheditor","versions":[">= 2.0.1, < 2.0.6"]}],"affected":[{"ecosystem":"Packagist","package":"pheditor/pheditor","vulnerableRanges":[">=2.0.1, <2.0.6"],"patched":["2.0.6"],"from":["GHSA-wg4w-wr5q-6vjc"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-49386","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pheditor-cve-2026-48030","parents":[{"from":"CVE-2026-54540","to":"CVE-2026-55578","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-9643-6xjp-vx57","via":"related"},{"kind":"version-step","provenance":"source","package":"Packagist:pheditor/pheditor","fromFixed":"2.0.5","toFixed":"2.0.6","daysApart":0},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-48030","published":"2026-07-27","fixed":"2.0.4","kev":false},{"cve":"CVE-2026-54540","published":"2026-07-27","fixed":"2.0.5","kev":false},{"cve":"CVE-2026-55578","published":"2026-07-27","fixed":"2.0.6","kev":false},{"cve":"CVE-2026-55579","published":"2026-07-27","fixed":"2.0.6","kev":false}],"package":"Packagist:pheditor/pheditor"}}