Pheditor’s terminal feature sanitizes user‑supplied commands using a character blocklist before passing them to shell_exec(). From version 2.0.1 up to just before 2.0.6, the blocklist was incomplete: the pipe (|), backtick (`), and newline (0x0A) characters were not blocked, even after the earlier fix that added $ to the list. An authenticated user with the terminal permission—which is enabled by default—can use these characters to bypass the TERMINAL_COMMANDS allowlist and inject shell operators, letting them execute arbitrary OS commands as the web‑server process. This is a classic OS command‑injection flaw (CWE‑78) that allows full compromise of the underlying system.

The affected vendor is pheditor, targeting Pheditor version 2.0.1 through 2.0.5 inclusive. Versions newer than 2.0.6 have applied the fix and are not vulnerable. The terminal permission is enabled by default, so any authenticated user granted terminal access is at risk.

The CVSS score of 8.8 indicates a high‑severity threat, and the EPSS score of <1% indicates a very low probability of widespread exploitation, though exploitation is straightforward for an authenticated user. The vulnerability is not catalogued in the CISA KEV list, but the exploitation requires only legitimate credentials and a user with terminal access, making the risk high, especially in environments where terminal permission is granted widely.