Hardcoded credentials in Pheditor (CVE-2026-55579)

CVE-2026-55579 is a hardcoded credentials vulnerability (CWE-798) in Pheditor, where the application ships with a default password of "admin" stored as an unsalted SHA-512 hash in the PHP source file with no mechanism to force a password change on first login. An unauthenticated remote attacker who authenticates with the default credentials gains full administrator access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution resulting in complete server compromise. Affected versions: - >= 2.0.1 We recommend updating to: 2.0.6. CVSS 9.8 · our assessment: act_now Vendor advisory: https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2 Details: https://vuln.today/cve/CVE-2026-55579