CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.

• CWE-798

• https://github.com/pheditor/pheditor/releases/tag/2.0.6
• https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2
• https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2

Published

Jul 27, 2026

Last Modified

Jul 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55570SiYuan is an open-source personal knowledge management syste…9
• CVE-2026-55574vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-55575LiquidJS is a Shopify / GitHub Pages compatible template eng…8.2
• CVE-2026-55576MaaAssistantArknights is a one-click tool for daily Arknight…8.8
• CVE-2026-55577ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-55578Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-5558A flaw has been found in PHPGurukul PHPGurukul Online Shoppi…6.3
• CVE-2026-55583Twenty is an open-source CRM (customer relationship manageme…7.6
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55592Dashy is a self-hostable personal dashboard. Prior to 4.3.7,…3.9
• CVE-2026-55594ImageMagick is free and open-source software used for editin…5.3