An OS Command Injection vulnerability in the terminal action handler of Pheditor allows any authenticated user, on versions 2.0.1 through 2.0.3, to inject shell metacharacters into the "dir" POST parameter. This bypasses the TERMINAL_COMMANDS whitelist and enables arbitrary OS command execution with web server privileges. The flaw follows CWE-78 and results in full Remote Code Execution.

The vulnerability exists only in the pheditor single-file PHP editor, affecting versions between 2.0.1 up to but excluding 2.0.4. Users running 2.0.1, 2.0.2, or 2.0.3 are impacted.

With a CVSS score of 9.9, the risk is extremely high. The EPSS score is 5%, indicating a higher but still nonzero exploitation probability. Although the vulnerability is not listed in CISA KEV, the authentication requirement and the web interface path make exploitation likely for sites using pheditor with default or weak credentials. Attackers must authenticate, then issue a crafted POST request that injects shell metacharacters into the "dir" parameter to execute arbitrary commands on the server.