Pheditor, a single‑file PHP editor, uses a terminal command feature that validates commands only by checking their prefix against a whitelist of allowed values. The validation check is followed by direct invocation of shell_exec() without escaping or blocking shell substitution syntax such as $(). An authenticated user granted terminal permission can craft a command that passes the whitelist test yet contains $() substitutions, enabling the execution of arbitrary shell code. The result is execution of arbitrary commands under the web server user account, compromising confidentiality, integrity, and availability of the entire system run by the server.

The vulnerability affects all releases of pheditor earlier than version 2.0.5. In particular, installations of pheditor 2.0.4 and earlier are vulnerable. The product is distributed as a single PHP file and marketed under the pheditor brand.

The CVSS score of 8.8 indicates high severity, consistent with remote code execution. EPSS < 1%, indicating a very low exploitation probability, but the issue is not listed in the CISA KEV catalog. Because the attack requires authenticated access to the web interface with terminal permission, it is most likely exploitable by attackers who have obtained user credentials or have compromised the site’s authentication system. Once authenticated, the attacker can bypass the command whitelist and fully control the server process.