CVE-2026-48030

Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.3

Description An OS Command Injection issue exists in the terminal action handler of the pheditor.php file. Authenticated users can execute arbitrary operating system commands with web server privileges by injecting shell metacharacters into the dir POST parameter. This occurs because the application validates shell metacharacters for the command parameter but fails to sanitize the dir parameter before passing it to the shell exec() function, allowing a complete bypass of the TERMINAL COMMANDS whitelist.

Recommendations Update Pheditor to version 2.0.4. As a temporary mitigation, restrict access to the terminal action handler or disable terminal permissions for users until the update is applied.