TI-2026-40118 CVE-2026-55579 · GHSA-p4h7-p9rj-2pq2
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Priority HIGH 82
Pheditor is a single-file editor and file manager written in PHP.
pheditor
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
pheditor records in CISA KEVNo pheditor vulnerabilities are listed in CISA KEV.
Records
4 records
TI-2026-35473 CVE-2026-48030 · GHSA-jvc5-6g7q-c843
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
Priority HIGH 76
Pheditor is a single-file editor and file manager written in PHP.
TI-2026-39379 CVE-2026-54540 · GHSA-9643-6xjp-vx57
Authenticated terminal command whitelist bypass in Pheditor
Priority HIGH 73
Pheditor is a single-file editor and file manager written in PHP.
TI-2026-40117 CVE-2026-55578 · GHSA-wg4w-wr5q-6vjc
OS command injection in pheditor
Priority MEDIUM 41
Pheditor is a single-file editor and file manager written in PHP.