A critical OS Command Injection vulnerability (CVE-2026-48030) was discovered in Pheditor, a single-file PHP editor and file manager. The flaw exists in versions 2.0.1 through 2.0.3 within the terminal action handler. Authenticated attackers can inject shell metacharacters into the 'dir' POST parameter to execute arbitrary OS commands. The vulnerability completely bypasses the TERMINAL_COMMANDS whitelist security control. Successful exploitation results in full Remote Code Execution (RCE) with web server privileges. The issue has been patched in version 2.0.4. Users are strongly advised to upgrade immediately.