CVE-2026-48030

CVE-2026-48030 is a command injection in Pheditor 2.0.3 and earlier, exploitable through the 'dir' parameter. The vulnerability bypasses a named whitelist called TERMINAL_COMMANDS — the critical detail is that this isn't a case of missing security controls, but controls that were implemented incompletely. The whitelist validates which command is requested, but the 'dir' parameter flows through shell string construction before that validation, allowing metacharacter injection via argument placement rather than command name. The patch in 2.0.4 presumably moves to array-based process execution (exec(array $cmd)) which separates arguments from shell interpretation, or implements proper escaping. Either way, the fix addresses the argument-construction layer, not just the command-name layer. Three things defenders should verify immediately: First, check your Pheditor version — if you're on anything before 2.0.4, you're vulnerable. Second, examine how the 'dir' parameter is handled in your deployment; the bug is that user input reaches shell construction functions (exec, shell_exec, system, passthru) without argument separation. Third, note that 'authenticated user' in the CVE is a low bar — many single-file PHP apps use hardcoded passwords or trivial authentication, so treat this as effectively accessible to anyone who can reach the login. The presence of TERMINAL_COMMANDS creates a false confidence problem. If you've previously audited this application and noted the whitelist as a security control, re-audit under the assumption that control was bypassable. Whitelists that validate command names but not argument construction are a known failure mode — they stop casual attackers but not those targeting this specific pattern. The existence of a named security constant can actually attract attackers who specifically look for bypassed whitelists in source code reviews.

Reviewed through automated stages and approved by a human before publication.