Pheditor 2.0.1-2.0.3 - OS Command Injection
CVE-2026-48030
Verified
Description
Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.
Severity
Critical
CVSS Score
9.9
Exploit Probability
8%
Affected Product
pheditor
Published Date
August 1, 2026
Template Author
juoum00000
CVE-2026-48030.yaml
9.9Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-48030
CWE ID:
cwe-78
Remediation Steps
Upgrade to version 2.0.4 or later.