Pheditor vulnerabilities
We track 4 vulnerabilities in Pheditor products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 27, 2026.
Latest Pheditor vulnerabilities
- 9.8 Critical severity
pheditor: Use of Hard-coded Credentials
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on f
- 8.8 High severity
pheditor: Improper Neutralization of Special Elements used in an OS Command
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After
- 8.8 High severity
pheditor: Improper Neutralization of Special Elements used in an OS Command
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS
- 9.9 Critical severity
pheditor: Improper Neutralization of Special Elements used in an OS Command
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell