Command whitelist bypass in Pheditor (CVE-2026-54540)

CVE-2026-54540 is an authenticated terminal command whitelist bypass in Pheditor 2.0.4. The terminal feature performs a prefix-based check against the configured TERMINAL_COMMANDS allowlist before passing the full user-supplied command string to shell_exec(), but does not block shell command substitution syntax such as $(). An authenticated user with the terminal permission can exploit this to execute arbitrary shell commands as the web server user, bypassing any TERMINAL_COMMANDS restriction administrators have configured. Affected versions: - <= 2.0.4 We recommend updating to: 2.0.5. CVSS 8.8 · our assessment: this_week Vendor advisory: https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57 Details: https://vuln.today/cve/CVE-2026-54540