OS command injection in Pheditor terminal feature (CVE-2026-55578)

CVE-2026-55578 is an OS command injection vulnerability (CWE-78) in the Pheditor terminal feature, where an incomplete character blocklist fails to block the pipe operator (`|`), backtick (`` ` ``), and newline byte (`0x0A`), allowing bypass of the `TERMINAL_COMMANDS` allowlist and execution of arbitrary OS commands via `shell_exec()`. Any authenticated user with the `terminal` permission, which is enabled by default, can exploit this to gain full read, write, and execute access as the web server user. This is a bypass of the partial fix introduced for GHSA-9643-6xjp-vx57. Affected versions: - >= 2.0.1 We recommend updating to: 2.0.6. CVSS 8.8 · our assessment: this_week Vendor advisory: https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc Details: https://vuln.today/cve/CVE-2026-55578