IA Squad
SearchPT
php · pheditor/pheditorCritical

pheditor: OS Command Injection in Terminal Handler

An OS Command Injection vulnerability was discovered in pheditor's terminal handler.

10 Jun 2026Read 1 minSeverity: act now

What changed

An OS Command Injection vulnerability was discovered in pheditor's terminal handler. The 'dir' POST parameter is passed to shell_exec() without sanitization, allowing authenticated users to inject arbitrary commands via shell metacharacters, bypassing the TERMINAL_COMMANDS whitelist.

Who it affects

Any authenticated pheditor user with terminal permission enabled (default configuration).

What to do today

Apply the fix by replacing `$dir` with `escapeshellarg($dir)` on line 586 of pheditor.php, or disable terminal permissions immediately.

The trail
Collected Audited Written Published