EUVD-2026-49385
GHSA-9643-6xjp-vx57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with terminal permission
-
DeliveryCraft allowed prefix plus $() substitution
-
ExploitBypass TERMINAL_COMMANDS allowlist
-
Executionshell_exec runs substituted command
-
ImpactExecute arbitrary commands as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Pheditor session whose account holds the 'terminal' permission (CVSS PR:L), and requires that the deployment actually uses the terminal feature with a configured TERMINAL_COMMANDS allowlist that the attacker is meant to be confined to - the vulnerability is precisely the ability to escape that allowlist. The concrete trigger is including shell command-substitution syntax ($() or ${}) after an allowed command prefix (e.g. ls$(...)), since only '&', ';', and '||' are filtered and validation is prefix-based. Limiting factors: exploitation is impossible without a valid credentialed account carrying the terminal permission, so it is not remote-unauthenticated; impact is bounded to the privileges of the web server user; and installations that disable the terminal feature or do not grant the terminal permission are not exploitable. |
| Impact | The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network reach, low complexity, and full CIA impact - but PR:L is the decisive limiter: exploitation requires an authenticated account that already holds the 'terminal' permission, which is itself a privileged capability. In practice this is a privilege-boundary bypass (escaping the allowlist) rather than an unauthenticated RCE, so real-world risk is gated by who can obtain terminal-permission accounts. No EPSS score, KEV entry, or SSVC decision data was provided; there is no CISA KEV listing, so this is not confirmed actively exploited. A reliable PoC exists (in the advisory), which raises practical exploitability for anyone with the required access. Net assessment: a genuine high-impact issue where credentialed/permissioned access is the real gate, more relevant as a defense-in-depth failure than as an internet-wide mass-exploitation threat. |
| Exploit ScenarioDerived | An attacker with a low-privilege Pheditor account that has been granted the 'terminal' permission - for example a junior operator restricted to only 'ls' - submits command=ls$(printf pheditor-terminal-bypass >/lab/app/site/proof.txt). The allowlist prefix check passes on 'ls', but the shell executes the $() substitution, writing an attacker-controlled file and demonstrating arbitrary command execution as the web server user; a published PoC confirms this works against a default install. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Authenticated command-injection in Pheditor 2.0.4 lets any user holding the 'terminal' permission bypass the TERMINAL_COMMANDS allowlist and run arbitrary OS commands as the web server user. The terminal handler only blocks '&', ';', and '||' and validates commands with a prefix check before handing the full string to shell_exec(), so shell substitution like ls$(...) satisfies the allowlist while executing attacker-controlled code. A working PoC is published in the GitHub advisory, though there is no public exploit identified as a standalone weaponized tool and no active exploitation reported.
RemediationAI
Vendor-released patch: 2.0.5 - upgrade Pheditor to 2.0.5 or later, which blocks the '$' character used for shell substitution (see the release notes at https://github.com/pheditor/pheditor/releases/tag/2.0.5 and advisory GHSA-9643-6xjp-vx57). If immediate patching is not possible, reduce exposure by revoking the 'terminal' permission from all non-essential accounts or disabling the terminal feature entirely (the vendor itself suggests disabling it by default), accepting the trade-off that legitimate in-app shell access is lost. As a stopgap you may set TERMINAL_COMMANDS to an empty value to deny all commands, but do not rely on the allowlist as a security boundary since prefix matching plus shell_exec() is inherently bypassable; also restrict network access to the Pheditor interface to trusted operators. The durable fix (per the reporter's guidance) is to run commands without a shell using an argument-array process API and require exact command-name matching rather than prefix matching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pheditor is a single-file PHP-based web file manager/editor (distributed as the Composer package pheditor/pheditor) that includes a terminal feature intended to be constrained to a small allowlist defined by the TERMINAL_COMMANDS constant. The root cause is CWE-78 (OS Command Injection): in pheditor.php the user-supplied $_POST['command'] is validated with substr()-based prefix matching (substr($command,0,strlen($value)) == $value) and a denylist of only three metacharacter sequences, then concatenated into a string passed to shell_exec() ('cd ... && ' . $command . ' && echo ; pwd'). Because shell_exec() invokes /bin/sh, shell features the denylist ignores - notably command substitution $() and ${}, plus backticks, pipes, newlines and redirection - are interpreted by the shell even though the leading token still matches an allowed command like 'ls'. The fix in 2.0.5 blocks the '$' character used for substitution.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web feature (AV:N), trivial substitution payload (AC:L), but requires an authenticated account with the terminal permission (PR:L); arbitrary OS command execution as web user gives full C/I/A.
Primary rating from Vendor (https://github.com/pheditor/pheditor).
CVSS VectorVendor: https://github.com/pheditor/pheditor
DescriptionCVE.org
Summary
Pheditor 2.0.4 has an authenticated terminal command whitelist bypass.
The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.
Details
Tested repository:
https://github.com/pheditor/pheditor
Tested commit:
62b43df7cb8956a9b0deb9bec278ca8676c890c5
Affected version:
Pheditor 2.0.4
Relevant code in pheditor.php:
- The terminal handler receives
$_POST['command']and stores it in$command. - It blocks only
&,;, and||. - It checks whether
$commandstarts with one of the configured values inTERMINAL_COMMANDS. - It then passes the full command string to
shell_exec().
Relevant logic:
$command = $_POST['command'];
if (strpos($command, '&') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false) {
echo json_error("Illegal character(s) in command (& ; ||)\n");
exit;
}
foreach ($terminal_commands as $value) {
$value = trim($value);
if (strlen($command) >= strlen($value) && substr($command, 0, strlen($value)) == $value) {
$command_found = true;
break;
}
}
$output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' && ') . $command . ' && echo \ ; pwd');Because the whitelist check is prefix-based and the full command is executed by a shell, a command such as ls$(...) passes when ls is allowed, while the command substitution is still executed by the shell.
PoC
This was reproduced locally with Docker and PHP 8.3.
For a strict test, the configured command allowlist was changed to only allow ls:
define('TERMINAL_COMMANDS', 'ls');Control request:
command=whoamiObserved result:
Command not allowed
Available commands:
lsBypass request:
command=ls$(printf pheditor-terminal-bypass >/lab/app/site/proof.txt)Observed result:
proof.txt is created with the content:
pheditor-terminal-bypassThis shows that even when only ls is allowed, arbitrary shell commands can still be executed through command substitution.
Impact
An authenticated user with the terminal permission can bypass the intended TERMINAL_COMMANDS restriction and execute arbitrary shell commands as the web server user.
This affects deployments where administrators rely on TERMINAL_COMMANDS to restrict terminal access to a small set of safe commands.
Suggested fixes:
- Avoid passing user-controlled command strings to
shell_exec(). - Parse the command into executable and arguments.
- Require an exact command name match instead of prefix matching.
- Execute without a shell, for example with an argument-array based process API.
- If shell execution remains necessary, reject shell metacharacters comprehensively, including command substitution syntax.
- Consider disabling the terminal feature by default.
Reporter credit requested:
shanjijian <shanjijian@gmail.com>
Articles & Coverage 1
Executive ViewAI
Pheditor 2.0.4 contains an authenticated command-injection vulnerability (CVE-2026-54540, CVSS 8.8) with publicly available exploit code that allows users with terminal permissions to execute arbitrary OS commands as the web server user through a command-validation bypass. Any user with terminal access can exploit this vulnerability for privilege escalation and system compromise, creating significant organizational risk. Immediate access control review and interim mitigations are required to prevent exploitation.
No vendor-released patch identified at time of analysis. Restrict 'terminal' permission to essential administrators only; disable the terminal feature entirely if not operationally critical; implement real-time audit logging and alerting on terminal command execution; deploy Web Application Firewall rules to block shell metacharacters and command substitution syntax; segment Pheditor network access through IP allowlisting and multi-factor authentication enforcement; isolate or air-gap instances to prevent lateral movement if exploited.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB