CVE-2026-54540

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54540
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54540.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54540
Aliases
Published
2026-07-27T17:53:53.891Z
Modified
2026-08-12T03:51:16.920073149Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Authenticated terminal command whitelist bypass in Pheditor
Details

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec(). Shell command substitution such as $() is not blocked, so an authenticated user with the terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the web server user. This issue has been patched in version 2.0.5.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54540.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pheditor/pheditor

Affected ranges

Type
GIT
Repo
https://github.com/pheditor/pheditor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e538f05b6faec99e5b23726bc9c17d6b57774297
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.5"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54540.json"