CVE-2026-48030
Pheditor, a PHP‑based file manager, had a critical OS command injection flaw that let authenticated users run any shell command. The bug existed in versions 2.0.1 through 2.0.3 and was fixed in version 2.0.4.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Pheditor versions 2.0.1 to 2.0.3 on any web server that hosts the application.
Real-world impact
An attacker who can log in to the application could execute arbitrary commands on the server, gaining full control and potentially compromising the entire system.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is exploitable over the network, requires only low effort, and gives attackers complete control over the affected server.
What to do about it
- 011. Download Pheditor version 2.0.4 or later from the official source.
- 022. Replace the existing Pheditor file with the updated version on your web server.
- 033. Ensure the web server points to the new file and restart the web server if necessary.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.