RCE in Pheditor
CVE-2026-54540
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configu…
Vulnerability class: Command Injection (OS Command Injection)
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Pheditor — versions < 2.0.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-54540?
- CVE-2026-54540 is a high-severity vulnerability in Pheditor, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-07-27.
- How severe is CVE-2026-54540?
- High severity. CVSS v3 base score is 8.8 out of 10.