CVE-2026-55578: Pheditor RCE Vulnerability

CVE-2026-55578 Overview

CVE-2026-55578 is a command injection vulnerability in Pheditor, a single-file PHP editor and file manager. The flaw affects versions 2.0.1 through versions before 2.0.6. The terminal feature relies on an incomplete character blocklist to sanitize user input before passing it to shell_exec(). Authenticated users with the terminal permission (enabled by default) can inject shell metacharacters to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary operating system commands as the web server user. The vulnerability is tracked as [CWE-78] (OS Command Injection) and was patched in version 2.0.6.

Critical Impact
Authenticated attackers can execute arbitrary OS commands as the web server user, leading to full compromise of the hosting environment.

Affected Products

Pheditor versions 2.0.1 through 2.0.5
Deployments with the terminal permission enabled (default configuration)
PHP-based single-file editor and file manager installations

Discovery Timeline

2026-07-27 - CVE-2026-55578 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-55578

Vulnerability Analysis

The vulnerability resides in Pheditor's terminal feature, which accepts user-supplied commands and executes them through PHP's shell_exec() function. The application attempts to restrict command execution through the TERMINAL_COMMANDS allowlist combined with a character blocklist that filters shell metacharacters. A prior fix documented in advisory GHSA-9643-6xjp-vx57 added the $ character to the blocklist to prevent variable expansion abuse. However, the blocklist remained incomplete after that patch.

The unfiltered characters include the single pipe |, the backtick `, and the newline byte 0x0A. Each of these enables command chaining or substitution outside of the allowlisted commands. An attacker can append | id to a permitted command to execute id after the initial command, or inject a newline followed by an arbitrary command. Backtick substitution allows nested command execution within an otherwise legitimate invocation.

Root Cause

The root cause is reliance on a denylist approach for sanitizing untrusted input passed to a shell interpreter. Denylist filtering is inherently fragile because it requires enumerating every metacharacter recognized by the underlying shell. The Pheditor blocklist omitted several standard POSIX shell control characters, allowing bypass of the intended allowlist enforcement.

Attack Vector

Exploitation requires an authenticated session with terminal permissions, which are enabled by default. The attacker submits a crafted command to the terminal endpoint containing one of the unfiltered characters followed by an arbitrary payload. The blocklist check passes, and shell_exec() executes the injected command chain in the context of the web server user. For example, submitting an allowlisted command suffixed with | whoami returns the identity of the web server process, confirming injection. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-55578

Indicators of Compromise

Web server access logs showing POST requests to the Pheditor terminal endpoint containing |, backtick, or URL-encoded newline (%0A) characters
Unexpected child processes spawned by the PHP or web server process (for example sh, bash, curl, wget, nc)
Outbound network connections from the web server user to unrecognized hosts following terminal activity
New or modified files in web-accessible directories written by the web server user

Detection Strategies

Monitor process execution telemetry for shell_exec() descendants of the PHP-FPM or web server process that fall outside the expected TERMINAL_COMMANDS allowlist
Alert on HTTP request bodies to Pheditor endpoints containing shell metacharacters |, `, or newline bytes
Correlate authenticated Pheditor sessions with subsequent anomalous shell activity on the host

Monitoring Recommendations

Enable command-line auditing on hosts running Pheditor and forward events to a centralized log platform
Track file integrity of PHP source files and web root directories to detect webshell deployment
Review authentication logs for Pheditor accounts and flag terminal usage from unfamiliar source addresses

How to Mitigate CVE-2026-55578

Immediate Actions Required

Upgrade Pheditor to version 2.0.6 or later, which removes the vulnerable characters from user-controllable input paths
Audit existing Pheditor user accounts and disable the terminal permission for users who do not require it
Rotate credentials and inspect hosts for signs of post-exploitation activity if Pheditor was internet-exposed

Patch Information

The issue is fixed in Pheditor 2.0.6. Download and release notes are available on the GitHub Release 2.0.6 page. The corresponding advisory is published at GHSA-wg4w-wr5q-6vjc.

Workarounds

Disable the terminal feature entirely by revoking the terminal permission from all user roles until the upgrade is applied
Restrict Pheditor access to trusted networks using web server access control lists or a reverse proxy
Deploy a web application firewall rule blocking requests to the terminal endpoint that contain |, backtick, or newline characters

bash

# Example WAF-style pattern to block metacharacter injection
# Reject POST bodies to the Pheditor terminal endpoint containing
# pipe, backtick, or URL-encoded newline characters
location ~ ^/pheditor/terminal {
    if ($request_body ~* "(\||%60|`|%0A)") {
        return 403;
    }
}