CVE-2026-48030: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler a
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-48030
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-480301.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-48030 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Pheditor is a
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalCVE-2026-55579: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
- highCVE-2026-55578: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
- highCVE-2026-54540: Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, ther…nvd · 2026-07-27
- criticalGHSA-f25v-x6vr-962g: Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Pas…ghsa · 2026-07-24
- highGHSA-g3hq-hphg-8fhh: Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — survivi…ghsa · 2026-07-24
- criticalGHSA-p4h7-p9rj-2pq2: Pheditor: Hardcoded default password 'admin' with no forced change enables full applicati…ghsa · 2026-07-16
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01