https://feed.craftedsignal.io/vendors/pheditor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 16 Jul 2026 20:13:37 +0000https://feed.craftedsignal.io/briefs/2026-07-pheditor-hardcoded-admin-password/Thu, 16 Jul 2026 20:13:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-pheditor-hardcoded-admin-password/Pheditor contains a critical vulnerability (CVE-2026-55579) where a hardcoded default password 'admin' with no forced change mechanism upon first login allows an unauthenticated attacker to gain full administrative access, enabling arbitrary file read/write and remote code execution through the application's terminal feature, leading to complete server compromise.Pheditor, a web-based file editor, is affected by a critical vulnerability, CVE-2026-55579, stemming from a hardcoded default password. The application ships with a default administrator password "admin," which is stored as an unsalted SHA-512 hash in the pheditor.php source file. There is no enforced mechanism to prompt a password change upon initial login, nor are there any lockout policies for incorrect attempts. This design flaw allows any unauthenticated attacker to bypass authentication by using the well-known default credentials. Upon successful login, the attacker gains full administrative control over the application's features, including file upload capabilities, arbitrary file read/write, and a terminal for remote code execution. This directly leads to server compromise, enabling data exfiltration, service disruption, and the establishment of persistent backdoors. All versions of Pheditor are affected.

Attack Chain

1. An unauthenticated attacker identifies a Pheditor instance exposed to the internet.
2. The attacker attempts to authenticate to the Pheditor web interface using the publicly known default password "admin."
3. Pheditor accepts the default credentials, grants the attacker an authenticated session, and sets a session cookie.
4. The attacker loads the Pheditor interface, extracts the CSRF token from the HTML source, and gains full administrative control over the application's features.
5. Leveraging the authenticated session and CSRF token, the attacker accesses the built-in terminal feature.
6. The attacker executes arbitrary commands on the underlying server via the terminal, achieving remote code execution.
7. The attacker proceeds with further actions such as arbitrary file upload, reading sensitive files, modifying application code, or deleting directories, leading to full server compromise and data impact.

Impact

The vulnerability (CVE-2026-55579, CWE-798) grants an unauthenticated attacker full administrator access to the Pheditor application if default credentials are in use. This leads to high impact across confidentiality, integrity, and availability. Attackers can read any files accessible by the web server process, potentially leading to sensitive data exposure. Integrity is compromised through the ability to write/delete files, upload webshells, or modify application code. Furthermore, the terminal feature allows for arbitrary command execution, providing complete control over the underlying server. This could lead to full system compromise, data exfiltration, defacement, or denial of service through deletion of critical files and directories.

Recommendation

• Immediately change the default 'admin' password on all Pheditor instances to a strong, unique password.
• Implement a robust password policy that forces users to change default passwords upon first login.
• Ensure Pheditor instances are not exposed to the public internet unless absolutely necessary, and protect them behind a firewall or VPN.
• Review web server access logs for POST requests to /pheditor.php originating from unknown IP addresses, especially if pheditor_password=admin was used in the request body.

]]>criticaladvisoryhardcoded-credentialsrceweb-applicationcveweb-vulnerabilitycommand-injectionphphttps://feed.craftedsignal.io/briefs/2026-07-pheditor-whitelist-bypass/Thu, 16 Jul 2026 20:02:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-pheditor-whitelist-bypass/Pheditor 2.0.4 contains an authenticated command injection vulnerability, CVE-2026-54540, allowing a user with `terminal` permissions to bypass the `TERMINAL_COMMANDS` whitelist by leveraging shell command substitution to execute arbitrary shell commands as the web server user.Pheditor version 2.0.4 is susceptible to an authenticated terminal command whitelist bypass vulnerability, identified as CVE-2026-54540. This flaw allows an attacker with legitimate access and terminal permissions to execute arbitrary operating system commands on the underlying web server. The vulnerability stems from how Pheditor's terminal feature validates user-submitted commands. While it checks if a command string begins with an entry from a predefined TERMINAL_COMMANDS whitelist, it fails to sanitize or block shell command substitution syntax, such as $(), before passing the full command directly to the shell_exec() PHP function. This permits an authenticated user to append malicious commands using substitution after a whitelisted prefix, effectively circumventing security controls and achieving remote code execution as the web server user. This is critical for deployments where TERMINAL_COMMANDS is relied upon to restrict administrative terminal access to a limited set of safe commands.

Attack Chain

1. An authenticated attacker logs into the Pheditor application with privileges that include terminal access.
2. The attacker accesses the terminal feature within the Pheditor application.
3. The attacker crafts a malicious command string that begins with a whitelisted command (e.g., ls) and appends a shell command substitution (e.g., $(arbitrary_command)).
4. The Pheditor application receives the command via a POST request to pheditor.php or a similar endpoint.
5. The application performs a prefix check, confirming that the initial part of the attacker's command (e.g., ls) matches an entry in the TERMINAL_COMMANDS allowlist.
6. Despite the presence of shell metacharacters for command substitution, the application passes the entire, unsanitized command string to the shell_exec() PHP function.
7. The underlying operating system shell executes the command, including the arbitrary commands embedded via substitution, leading to remote code execution as the web server user.

Impact

Successful exploitation of CVE-2026-54540 grants an authenticated attacker the ability to execute arbitrary shell commands as the web server user. This can lead to complete compromise of the Pheditor instance and potentially the underlying server. Attackers could exfiltrate sensitive data, deface the website, install backdoors, or pivot to other systems within the network. This vulnerability is particularly impactful for organizations that deploy Pheditor and rely on the TERMINAL_COMMANDS configuration to restrict terminal access to a controlled set of operations, as these restrictions can be trivially bypassed.

Recommendation

• Deploy the Sigma rule provided in this brief to detect attempts at command substitution in Pheditor's terminal input.
• Monitor webserver logs for HTTP POST requests to pheditor.php or similar endpoints that contain the command parameter with shell command substitution patterns (e.g., $()).
• Patch Pheditor to a version greater than 2.0.4, or implement the suggested fixes from the advisory, which include avoiding shell_exec() for user-controlled input, requiring exact command matches, or comprehensively rejecting shell metacharacters.

]]>highadvisoryweb-vulnerabilitycommand-injectionphp