ByteOS Network

NVD Vulnerability Details :

CVE-2026-48030

Received

Source-security-advisories@github.com

Published At-27 Jul, 2026 | 18:16

Updated At-27 Jul, 2026 | 19:17

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
			N/A

Type: Secondary

Version: 3.1

Base score: 9.9

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

Weaknesses

CWE ID	Type	Source
CWE-78	Secondary	security-advisories@github.com

CWE ID: CWE-78

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/pheditor/pheditor/releases/tag/2.0.4	security-advisories@github.com	N/A
https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843	security-advisories@github.com	N/A
https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A