CVE-2026-48030: Pheditor OS Command Injection RCE Flaw

CVE-2026-48030 Overview

CVE-2026-48030 is an OS Command Injection vulnerability [CWE-78] in Pheditor, a single-file PHP editor and file manager. The flaw resides in the terminal action handler and affects versions from 2.0.1 up to but not including 2.0.4. Any authenticated user can inject shell metacharacters into the dir POST parameter to bypass the TERMINAL_COMMANDS whitelist. Successful exploitation results in arbitrary OS command execution with the privileges of the web server process. The maintainers patched the issue in version 2.0.4.

Critical Impact
Authenticated attackers can achieve full Remote Code Execution on the underlying host by injecting shell metacharacters into the dir POST parameter of the terminal handler.

Affected Products

Pheditor version 2.0.1
Pheditor versions between 2.0.1 and 2.0.4 (exclusive)
Pheditor versions prior to 2.0.4

Discovery Timeline

2026-07-27 - CVE-2026-48030 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-48030

Vulnerability Analysis

Pheditor exposes a terminal action handler that accepts a working directory value through the dir POST parameter. The handler was designed to constrain execution to entries defined in the TERMINAL_COMMANDS whitelist. However, the dir parameter is concatenated into a shell command string without sanitization or metacharacter escaping. This design flaw allows attackers to escape the intended command context using standard shell separators such as ;, &&, |, or backticks. The whitelist enforcement only inspects the primary command token and does not evaluate arguments passed through the dir field. As a result, the whitelist provides no protective value once the injection point is reached. Execution occurs under the web server account, providing access to files, environment variables, and network resources reachable by that user.

Root Cause

The root cause is unsafe construction of an operating system command from untrusted input. The dir parameter is embedded into a shell invocation without input validation or safe API usage such as parameterized process spawning. Whitelisting the command name while leaving arguments unfiltered breaks the intended trust boundary.

Attack Vector

Exploitation requires an authenticated session on the Pheditor instance. The attacker submits a POST request to the terminal action endpoint with a dir value containing shell metacharacters followed by an arbitrary command. The server executes the injected payload before returning the response. Because Pheditor is typically deployed as a single-file utility on internet-facing web servers, exposure to network-based attackers is common.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-jvc5-6g7q-c843 for maintainer details.

Detection Methods for CVE-2026-48030

Indicators of Compromise

POST requests to Pheditor terminal endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks inside the dir parameter.
Unexpected child processes spawned by the PHP interpreter or web server user, such as sh, bash, curl, wget, nc, or python.
New or modified files in the Pheditor deployment directory outside normal editing activity.
Outbound network connections initiated by the web server process to unfamiliar hosts.

Detection Strategies

Inspect web server access logs for POST requests to the Pheditor terminal action with anomalous dir values.
Alert on process lineage where the web server or PHP-FPM worker spawns shell interpreters or reconnaissance tools.
Correlate authenticated Pheditor sessions with subsequent process creation and outbound network events on the same host.

Monitoring Recommendations

Enable command-line auditing on hosts running Pheditor and forward events to a centralized log platform.
Track file integrity for the Pheditor script and any writable directories under the web root.
Monitor for privilege escalation attempts following suspicious process activity from the web server account.

How to Mitigate CVE-2026-48030

Immediate Actions Required

Upgrade Pheditor to version 2.0.4 or later on all deployments.
Restrict access to Pheditor to trusted administrators via network controls and authentication.
Rotate credentials for accounts that could authenticate to affected Pheditor instances.
Review web server and application logs for prior exploitation attempts against the terminal handler.

Patch Information

The vendor addressed CVE-2026-48030 in Pheditor 2.0.4. Refer to the GitHub Release Note 2.0.4 and the GitHub Security Advisory GHSA-jvc5-6g7q-c843 for patch details.

Workarounds

Remove or disable the Pheditor terminal action handler until the upgrade is completed.
Place Pheditor behind a reverse proxy that blocks shell metacharacters in the dir POST parameter.
Run the web server process under a least-privilege account with no shell access and restricted filesystem permissions.

bash

# Example: block requests containing shell metacharacters in the dir parameter
# NGINX snippet placed in the Pheditor server block
if ($request_method = POST) {
    if ($request_body ~* "dir=[^&]*[;|&\\$\\`]") {
        return 403;
    }
}