CVE-2026-55579 is a critical vulnerability in Pheditor, a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password 'admin' (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file ed [truncated]
CVE-2026-55578 is a high-severity vulnerability in Pheditor's terminal feature, allowing authenticated users to execute arbitrary OS commands as the web server. The issue arises from an incomplete character blocklist used to sanitize user-supplied commands before passing them to shell_exec(). Affected users should prioritize upgrading to version 2.0.6. The vulnerability has a CVSS score of 8.8 and is cons [truncated]
CVE-2026-48030 is an OS Command Injection vulnerability in Pheditor, a single-file editor and file manager written in PHP. The vulnerability affects versions 2.0.1 to before 2.0.4. An authenticated user can execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privile [truncated]
