CVE-2026-48030

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48030", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T17:44:09.588Z", "datePublished": "2026-07-27T17:53:34.438Z", "dateUpdated": "2026-07-27T18:53:42.856Z"}, "containers": {"cna": {"title": "Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"}, {"name": "https://github.com/pheditor/pheditor/releases/tag/2.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4"}], "affected": [{"vendor": "pheditor", "product": "pheditor", "versions": [{"version": ">= 2.0.1, < 2.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T17:53:34.438Z"}, "descriptions": [{"lang": "en", "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."}], "source": {"advisory": "GHSA-jvc5-6g7q-c843", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T18:53:32.014022Z", "id": "CVE-2026-48030", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:53:42.856Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48030", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T18:53:32.014022Z"}}}], "references": [{"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:53:16.903Z"}}], "cna": {"title": "Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)", "source": {"advisory": "GHSA-jvc5-6g7q-c843", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pheditor", "product": "pheditor", "versions": [{"status": "affected", "version": ">= 2.0.1, < 2.0.4"}]}], "references": [{"url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "name": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4", "name": "https://github.com/pheditor/pheditor/releases/tag/2.0.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-27T17:53:34.438Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48030", "state": "PUBLISHED", "dateUpdated": "2026-07-27T18:53:42.856Z", "dateReserved": "2026-05-20T17:44:09.588Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-27T17:53:34.438Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pheditor", "vendor": "pheditor", "versions": [{"status": "affected", "version": ">= 2.0.1, < 2.0.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4."}, {"lang": "es", "value": "Pheditor es un editor de un solo archivo y gestor de archivos escrito en PHP. Desde la versi\u00f3n 2.0.1 hasta antes de la versi\u00f3n 2.0.4, una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el gestor de acciones de la terminal permite a cualquier usuario autenticado ejecutar comandos arbitrarios del sistema operativo inyectando metacaracteres de shell en el par\u00e1metro POST \u2019dir\u2019, eludiendo completamente la lista blanca TERMINAL_COMMANDS y logrando la ejecuci\u00f3n remota de c\u00f3digo completa con privilegios de servidor web. Este problema ha sido parcheado en la versi\u00f3n 2.0.4."}], "id": "CVE-2026-48030", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48030", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T18:53:32.014022Z", "version": "2.0.3"}}]}, "published": "2026-07-27T18:16:55.347", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pheditor/pheditor/releases/tag/2.0.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.1,2.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "pheditor", "vendor": "pheditor"}], "created": "2026-07-28T15:00:04.779270+00:00", "updated": "2026-09-24T22:00:21.992664+00:00", "vendors": ["pheditor", "pheditor$PRODUCT$pheditor"]}