Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-55578
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-27 Jul, 2026 | 17:54
Updated At-27 Jul, 2026 | 17:54
Rejected At-
▼CVE Numbering Authority (CNA)
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.

Affected Products
Vendor
pheditor
Product
pheditor
Versions
Affected
  • >= 2.0.1, < 2.0.6
Problem Types
TypeCWE IDDescription
CWECWE-78CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Type: CWE
CWE ID: CWE-78
Description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Metrics
VersionBase scoreBase severityVector
3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc
x_refsource_CONFIRM
https://github.com/advisories/GHSA-9643-6xjp-vx57
x_refsource_MISC
https://github.com/pheditor/pheditor/releases/tag/2.0.6
x_refsource_MISC
Hyperlink: https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/advisories/GHSA-9643-6xjp-vx57
Resource:
x_refsource_MISC
Hyperlink: https://github.com/pheditor/pheditor/releases/tag/2.0.6
Resource:
x_refsource_MISC
Details not found