What is CVE-2026-48030?

CVE-2026-48030 is a critical-severity vulnerability in Pheditor, classified under OS Command Injection. CVSS score: 9.9/10. Published 2026-07-27.

How severe is CVE-2026-48030?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Pheditor

CVE-2026-48030

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS comman…

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Pheditor — versions >= 2.0.1, < 2.0.4

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-48030?: CVE-2026-48030 is a critical-severity vulnerability in Pheditor, classified under OS Command Injection. CVSS score: 9.9/10. Published 2026-07-27.
How severe is CVE-2026-48030?: Critical severity. CVSS v3 base score is 9.9 out of 10.