CVE-2026-55578
CVE-2026-55578 · Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) remain unblocked. An authenticated user with the terminal permission (enabled by default) can leverage any of these to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This issue has been patched in version 2.0.6.
CVSS 8.8 · Высокий · EPSS 0,7% · Есть исправление
- Опубликовано
- Обновлено
Стек: php
Затронутые продукты и версии
pheditor
- Версии
- >= 2.0.1, < 2.0.6: Затронуто
Нет опубликованного исправления
pheditor/pheditor Packagist
- Версии
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- Затронутые диапазоны версий
- ECOSYSTEM: ≥ 2.0.1, < 2.0.6
Обновитесь до 2.0.6