CVE-2026-54540
Summary
Pheditor 2.0.4 has an authenticated terminal command whitelist bypass.
The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.
Details
Tested repository:
https://github.com/pheditor/pheditor
Tested commit:
62b43df7cb8956a9b0deb9bec278ca8676c890c5
Affected version:
Pheditor 2.0.4
Relevant code in pheditor.php:
- The terminal handler receives $_POST['command'] and stores it in $command.
- It blocks only &, ;, and ||.
- It checks whether $command starts with one of the configured values in TERMINAL_COMMANDS.
- It then passes the full command string to shell_exec().
Relevant logic:
$command = $_POST['command'];
if (strpos($command, '&') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false) {
echo json_error("Illegal character(s) in command (& ; ||)\n");
exit;
}
foreach ($terminal_commands as $value) {
$value = trim($value);
if (strlen($command) >= strlen($value) && substr($command, 0, strlen($value)) == $value) {
$command_found = true;
break;
}
}
$output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' && ') . $command . ' && echo \ ; pwd');
Because the whitelist check is prefix-based and the full command is executed by a shell, a command such as ls$(...) passes when ls is allowed, while the command substitution is still executed by the shell.
PoC
This was reproduced locally with Docker and PHP 8.3.
For a strict test, the configured command allowlist was changed to only allow ls:
define('TERMINAL_COMMANDS', 'ls');
Control request:
command=whoami
Observed result:
Command not allowed
Available commands:
ls
Bypass request:
command=ls$(printf pheditor-terminal-bypass >/la
⚡ Watch CVE-2026-54540
Get an email if CVE-2026-54540 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54540)