CVE-2026-54540

Name of the Vulnerable Software and Affected Versions Pheditor versions prior to 2.0.5

Description An authenticated user with terminal permissions can bypass the command whitelist to execute arbitrary shell commands as the web server user. The terminal feature verifies if the submitted command starts with one of the values defined in TERMINAL COMMANDS before passing the full string to the shell exec() function. Because the check is prefix-based and does not block shell command substitution such as $(), an attacker can append malicious commands that the shell will still execute. The vulnerable logic processes the command parameter from a POST request.

Recommendations Update to version 2.0.5. As a temporary mitigation, restrict or disable the terminal feature for users until the update is applied.