CVE-2026-55578

Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5

Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec() function. While a blocklist is used to filter dangerous characters, it is incomplete and fails to block the single pipe (|), backtick (`), and the newline byte (0x0A). An authenticated user with the terminal permission, which is enabled by default, can use these characters to bypass the TERMINAL COMMANDS allowlist. This allows the execution of arbitrary operating system commands with the privileges of the web server user via the command parameter in the terminal handler.

Recommendations Update to version 2.0.6. As a temporary workaround, restrict or disable the terminal permission for authenticated users until the update is applied.