Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.

Severity: All Critical High

Library: pheditor/pheditor

CVE-2026-55579 CRITICAL CVSS 9.8 Verified Advisory Jul 16, 2026

Hardcoded credentials in Pheditor (CVE-2026-55579)

CVE-2026-55579 is a hardcoded credentials vulnerability (CWE-798) in Pheditor, where the application ships with a default password of "admin" stored as an unsalted SHA-512 hash in the PHP source file with no mechanism...

Fixed in 2.0.6

RCE Authentication Bypass File Upload PHP

CVE-2026-55578 HIGH CVSS 8.8 Verified Advisory Jul 16, 2026

OS command injection in Pheditor terminal feature (CVE-2026-55578)

CVE-2026-55578 is an OS command injection vulnerability (CWE-78) in the Pheditor terminal feature, where an incomplete character blocklist fails to block the pipe operator (`|`), backtick (`` ` ``), and newline byte (...

Fixed in 2.0.6

Command Injection PHP

CVE-2026-54540 HIGH CVSS 8.8 Verified Advisory Jul 16, 2026

Command whitelist bypass in Pheditor (CVE-2026-54540)

CVE-2026-54540 is an authenticated terminal command whitelist bypass in Pheditor 2.0.4. The terminal feature performs a prefix-based check against the configured TERMINAL_COMMANDS allowlist before passing the full use...

Fixed in 2.0.5

Command Injection Docker PHP