A critical OS Command Injection vulnerability (CVE-2026-48030) was discovered in Pheditor, a single-file PHP editor and file manager. The flaw affects versions 2.0.1 through 2.0.3 and resides in the terminal action handler. Authenticated users can exploit the vulnerability by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist. Successful exploitation allows full Remote Code Execution (RCE) with web server privileges. The vulnerability requires authentication but poses a severe risk once an attacker has valid credentials. The issue has been patched in version 2.0.4. Users are strongly advised to upgrade immediately to mitigate the risk of full system compromise.