CVE-2026-55578

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.

• CWE-78

• https://github.com/advisories/GHSA-9643-6xjp-vx57
• https://github.com/pheditor/pheditor/releases/tag/2.0.6
• https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc
• https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc

Published

Jul 27, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5557A vulnerability was detected in badlogic pi-mono up to 0.58.…6.3
• CVE-2026-55570SiYuan is an open-source personal knowledge management syste…9
• CVE-2026-55574vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-55575LiquidJS is a Shopify / GitHub Pages compatible template eng…8.2
• CVE-2026-55576MaaAssistantArknights is a one-click tool for daily Arknight…8.8
• CVE-2026-55577ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-55579Pheditor is a single-file editor and file manager written in…9.8
• CVE-2026-5558A flaw has been found in PHPGurukul PHPGurukul Online Shoppi…6.3
• CVE-2026-55583Twenty is an open-source CRM (customer relationship manageme…7.6
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55592Dashy is a self-hostable personal dashboard. Prior to 4.3.7,…3.9