Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The termi…

Pheditor, a single-file PHP editor and file manager, contains an authenticated terminal command whitelist bypass vulnerability prior to version 2.0.5. The terminal feature validates commands by checking if they start with values in the TERMINAL_COMMANDS allowlist, but passes the full command string to shell_exec() without sanitization. Shell command substitution syntax such as $() is not blocked, allowing authenticated users with terminal permissions to inject and execute arbitrary shell commands as the web server user. This effectively renders the command allowlist protection useless. The vulnerability requires authentication and the terminal permission to exploit. A patch has been released in version 2.0.5 addressing this bypass. Users are advised to upgrade immediately to mitigate the risk of arbitrary command execution.