muslimbek-0x/cve-2026-48030Proof-of-concept exploit for CVE-2026-48030, a critical OS command injection in Pheditor 2.0.1-2.0.3. Includes vulnerable code analysis, PoC script, and patching guidance for security researchers.
| Field | Details |
|---|
| CVE ID | CVE-2026-48030 |
| Product | pheditor |
| Vendor | Hamid Samak |
| Affected Versions | 2.0.1, 2.0.2, 2.0.3 |
| Patched Version | 2.0.4 |
| Severity | Critical |
| CVSS Score | 9.9 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CWE | CWE-78 (OS Command Injection) |
| Discovered by | Muslimbek Burxonov |
A critical OS Command Injection vulnerability exists in the terminal action
handler of pheditor.php. The dir POST parameter is concatenated directly
into shell_exec() without sanitization, allowing an authenticated attacker
to bypass the TERMINAL_COMMANDS whitelist and execute arbitrary OS commands.
pheditor.php, line 586:
$command = $_POST['command']; // ✓ metacharacters checked
$dir = $_POST['dir']; // ✗ NOT checked — vulnerable
// Check applies to $command only, NOT $dir
if (strpos($command, '&') !== false ||
strpos($command, ';') !== false ||
strpos($command, '||') !== false) {
die(...);
}
// $dir injected unsanitized into shell_exec
$output = shell_exec(
(empty($dir) ? null : 'cd ' . $dir . ' && ')
. $command . ' && echo \ ; pwd'
);
python3 poc.py --target http://TARGET/pheditor.php --password admin
See poc.py for full PoC script.
pheditor.php, line 586 — replace:
// BEFORE (vulnerable)
'cd ' . $dir
// AFTER (patched)
'cd ' . escapeshellarg($dir)
This PoC is provided for educational and research purposes only. Use only on systems you have explicit permission to test.