CVE-2026-55579: Pheditor Auth Bypass Vulnerability

CVE-2026-55579 Overview

Pheditor is a single-file editor and file manager written in PHP. Versions from 2.0.1 up to but not including 2.0.6 ship with a hardcoded default administrative password (admin), stored as a SHA-512 hash at pheditor.php:11. The application does not force a password change on first login. Attackers who reach a Pheditor instance can log in with the default credentials and gain full access to the file editor, file upload, and terminal features. This access enables arbitrary file read and write operations along with remote code execution on the underlying host. The issue is tracked as [CWE-798] Use of Hard-coded Credentials and is fixed in version 2.0.6.

Critical Impact
Any internet-reachable Pheditor deployment running versions 2.0.1 through 2.0.5 with default credentials can be fully compromised by unauthenticated attackers, resulting in remote code execution.

Affected Products

Pheditor versions 2.0.1 through 2.0.5
Pheditor single-file PHP editor and file manager component
Web servers hosting vulnerable Pheditor deployments

Discovery Timeline

2026-07-27 - CVE-2026-55579 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-55579

Vulnerability Analysis

Pheditor is distributed as a single PHP file that provides administrative capabilities including file editing, file upload, and an interactive terminal. Authentication is enforced through a password check against a hardcoded SHA-512 hash embedded at line 11 of pheditor.php. The default plaintext password is admin. The application does not prompt users to rotate this credential on first use and does not disable the default account until a new password is set.

An attacker who identifies a Pheditor instance can authenticate immediately using the known credential. Once authenticated, the attacker gains access to every administrative feature exposed by the application. Because Pheditor includes a terminal interface and file upload, authentication yields immediate code execution on the web server.

Root Cause

The root cause is the use of a hardcoded credential shipped in the distributed source ([CWE-798]). Every deployment inherits the same SHA-512 hash at pheditor.php:11 and the same corresponding plaintext value. No first-run configuration step forces the administrator to replace this value, so any operator who forgets or overlooks the credential leaves the instance fully open.

Attack Vector

Exploitation requires only network access to the Pheditor endpoint. The attacker submits the default password admin to the login form. On successful authentication, the attacker uses the built-in terminal or the file upload feature to place a PHP payload on disk and execute arbitrary commands under the web server user. No user interaction and no prior privileges are required. See the GitHub Security Advisory GHSA-p4h7-p9rj-2pq2 for vendor details.

Detection Methods for CVE-2026-55579

Indicators of Compromise

Successful HTTP POST authentication requests to Pheditor login endpoints originating from unexpected external IP addresses.
Newly created or modified PHP files in web-accessible directories following a Pheditor login event.
Web server processes (for example, www-data, apache, nginx) spawning shells or command interpreters such as /bin/sh, bash, or cmd.exe.
Outbound connections from the web server host to unrecognized destinations shortly after Pheditor access.

Detection Strategies

Inventory all web roots for the presence of pheditor.php and confirm the deployed version against the fixed release.
Alert on process trees where the web server user launches interactive shells, package managers, or download utilities such as curl or wget.
Correlate authentication events on Pheditor with subsequent file writes to web-accessible directories.
Monitor for uploads of files with executable extensions through Pheditor request paths.

Monitoring Recommendations

Ingest web server access logs into a centralized analytics platform and search for requests to pheditor.php.
Track file integrity on directories that host PHP applications and alert on unauthorized modifications.
Baseline outbound network traffic from web servers and alert on deviations following administrative logins.

How to Mitigate CVE-2026-55579

Immediate Actions Required

Upgrade every Pheditor instance to version 2.0.6 or later without delay.
Rotate the administrative password on every Pheditor deployment, including any legacy instances that remain online.
Audit web-accessible directories for unauthorized PHP files, webshells, or scheduled tasks created since Pheditor was installed.
Restrict network access to Pheditor endpoints using firewall rules, VPN gating, or IP allow-lists.

Patch Information

The maintainers released a fix in Pheditor 2.0.6. Refer to the GitHub Release 2.0.6 notes and the GitHub Security Advisory GHSA-p4h7-p9rj-2pq2 for upgrade instructions and remediation guidance.

Workarounds

Remove Pheditor from production hosts if it is not actively required.
Place Pheditor behind an authenticated reverse proxy that enforces an independent access control layer.
Manually replace the SHA-512 hash at pheditor.php:11 with a hash generated from a strong, unique password if upgrading is not immediately feasible.

bash

# Generate a replacement SHA-512 hash for the hardcoded credential
printf '%s' 'REPLACE_WITH_STRONG_PASSWORD' | sha512sum

# Restrict access to the Pheditor endpoint at the web server layer (nginx example)
# location = /pheditor.php {
#     allow 10.0.0.0/8;
#     deny all;
# }