CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CVE-2026-55578

highCVSS 8.8covered by 2 sourcesfirst seen 2026-07-16
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS` allowlist and execute arbitrary OS commands as the web server user. Details Tested repository: https://github.com/pheditor/pheditor Tested commit: e538f05b6faec99e5b23726bc9c17d6b57774297 (current HEAD on main) Affected version: Pheditor 2.0.1+ The terminal handler receives $_POST['command'] and passes it to shell_exec() at pheditor.php:586: $output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' && ') . $command . ' && echo \ ; pwd'); The blocklist at pheditor.php:557 checks for &, ;, ||, and $, but does not block |, , or newline (0x0A`): if (strpos($command, '&') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false || strpos($command, '$') !== false) { echo json_error("Illegal character(s) in command (& ; ||)\n"); exit; } The TERMINAL_COMMANDS prefix check at pheditor.php:566-573 only validates that the command starts with an allowed name. All three bypasses start with a whitelisted command prefix. Bypass 1 — Single pipe |: The filter checks for || but not single |. Payload ls | id passes both the blocklist and the whitelist (starts with ls). The shell executes: cd '<dir>' && ls | id && echo \ ; pwd, running id. Bypass 2 — Backtick `: Backtick is not in the blocklist. Payload echo id passes the blocklist and whitelist (starts with echo). The shell executes id inside backtick substitution. Bypass 3 — Newline 0x0A: A literal newline byte is not in the blocklist. Payload ls\ntouch /tmp/proof (where \n is 0x0A) passes both checks. Only the first line is validated against

⚡ Watch CVE-2026-55578

Get an email if CVE-2026-55578 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Advisory coverage (2)

External references

NVD record for CVE-2026-55578

CVE.org record

Embed the live status

CVE-2026-55578 live status badge — this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55578 status](https://www.csirts.com/badge/CVE-2026-55578)](https://www.csirts.com/cve/CVE-2026-55578)