CVE-2026-54540: Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks w

highCVSS 8.8CVE-2026-54540

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.8
Published: 2026-07-27
Last updated: 2026-07-27
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54540

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-545400.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54540	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highGHSA-9643-6xjp-vx57: Pheditor has an authenticated terminal command whitelist bypassghsa

Recent advisories for Pheditor is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-55579: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
highCVE-2026-55578: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
criticalCVE-2026-48030: Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before…nvd · 2026-07-27
criticalGHSA-f25v-x6vr-962g: Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Pas…ghsa · 2026-07-24
highGHSA-g3hq-hphg-8fhh: Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — survivi…ghsa · 2026-07-24
criticalGHSA-p4h7-p9rj-2pq2: Pheditor: Hardcoded default password 'admin' with no forced change enables full applicati…ghsa · 2026-07-16