Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplet…

Pheditor, a single-file PHP editor and file manager, contains a critical command injection vulnerability in versions 2.0.1 through 2.0.5. The terminal feature uses an incomplete character blocklist when sanitizing user input before passing it to shell_exec(). Despite a prior fix that added the dollar sign ($) to the blocklist, the pipe (|), backtick (`), and newline byte (0x0A) characters remain unblocked. An authenticated user with terminal permissions (enabled by default) can exploit these characters to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. This represents a bypass of a previous security fix (GHSA-9643-6xjp-vx57). The vulnerability has been fully patched in version 2.0.6 of Pheditor.