External risk intelligence

Pheditor OS Command Injection Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48030

Pheditor is a web-based file manager and editor. Such tools are commonly deployed as web applications accessible over the network to manage files remotely, placing the application's interface and its input handlers directly in the path of network traffic.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Pheditor, a PHP-based file management tool, that could allow authenticated users to execute arbitrary commands on the web server. This issue stems from a flaw in how the terminal action handler processes user input, potentially leading to complete system compromise with web server privileges. The vulnerability has been addressed in the latest version.

Unauthenticated command execution via file manager.
Affects web applications managing files remotely.
Confirm relevance and assess exposure to the tool.

Attack Path

How an attacker could exploit the issue

An attacker with user-level access to Pheditor can exploit a vulnerability in its terminal action handler. By submitting a request with specially crafted input in the 'dir' parameter, they can bypass security checks and execute arbitrary operating system commands. This allows for complete remote code execution with the privileges of the web server.

Authenticated user access required.
Terminal action handler accepts malicious input.
Full remote code execution achieved.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an OS Command Injection vulnerability in Pheditor could allow an authenticated user to execute arbitrary commands on the server. This could occur by injecting shell metacharacters into the 'dir' POST parameter, bypassing security checks and enabling remote code execution with the privileges of the web server.

Arbitrary OS commands may be executed.
Injecting shell metacharacters into a parameter.
Full remote code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Pheditor, a PHP-based file editor, allows authenticated users to execute arbitrary OS commands. The first step is to identify all Pheditor instances, confirm their reachability and business criticality, and then determine the accountable owner for remediation.

App owners and infrastructure teams.
Confirm Pheditor instances and reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Pheditor and how is it used?

Pheditor is a lightweight, single-file editor and file management utility developed in PHP. Users typically deploy it on web servers to conveniently view, edit, and organize files remotely through a browser-based interface. Because it provides direct file system interaction, it serves as a centralized hub for managing server-side content.

What is the OS Command Injection vulnerability in CVE-2026-48030?

This vulnerability, classified as CWE-78, occurs when an application improperly filters input before passing it to a system shell. In this case, Pheditor fails to sanitize the 'dir' parameter, allowing an attacker to inject shell metacharacters. This forces the server to execute unintended commands, granting the attacker the same power and access level as the web server software itself.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specific POST request to the terminal action handler where the 'dir' parameter contains malicious shell commands. It is important to note that this requires the attacker to have an active, authenticated user account within Pheditor; an unauthenticated user cannot trigger the vulnerability through this specific path.

Do I need to worry if my Pheditor instance is not internet-facing?

According to Halo Surface Signal, Pheditor is often deployed as a web application intended for network access, which increases the likelihood of external exposure. If your instance is strictly internal, the risk is lower but still present; a compromised internal account could leverage this flaw to escalate privileges or pivot within your infrastructure.

How should I respond to this vulnerability?

First, conduct an inventory to locate all active Pheditor installations across your environment. Once identified, verify which instances are running vulnerable versions 2.0.1 through 2.0.3. The primary fix is to update the software to version 2.0.4 or later, which includes the necessary patches to properly validate input and secure the terminal action handler.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.