fkie_cve-2026-55578

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.

GHSA-wg4w-wr5q-6vjc — Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and…

Affected: Packagist: pheditor/pheditor

### Summary

The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to `shell_exec()`. After the fix for GHSA-9643-6xjp-vx57 (which added `$` to the blocklist), the characters `|` (single pipe), `` ` `` (backtick), and the newline byte (`0x0A`) remain unblocked. An authenticated user with the `terminal` permission (enabled by default) can leverage any of these to bypass the `TERMINAL_COMMANDS` allowlist and execute arbitrary OS commands as the web server user.

### Details

Tested repository: https://github.com/pheditor/pheditor

Tested commit: `e538f05b6faec99e5b23726bc9c17d6b57774297` (current HEAD on `main`)

Affected version: Pheditor 2.0.1+

The terminal handler receives `$_POST['command']` and passes it to `shell_exec()` at `pheditor.php:586`:

```php $output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' && ') . $command . ' && echo \ ; pwd'); ```

The blocklist at `pheditor.php:557` checks for `&`, `;`, `||`, and `$`, but does not block `|`, `` ` ``, or newline (`0x0A`):

```php if (strpos($command, '&') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false || strpos($command, '$') !== false) { echo json_error("Illegal character(s) in command (& ; ||)\n"); exit; } ```

The `TERMINAL_COMMANDS` prefix check at `pheditor.php:566-573` only validates that the command starts with an allowed name. All three bypasses start with a whitelisted command…

Most recent entries from all

fkie_cve-2026-55578

GHSA-wg4w-wr5q-6vjc — Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and…