Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplet…

Pheditor, a PHP-based single-file editor and file manager, contains a critical command injection vulnerability in its terminal feature affecting versions 2.0.1 through 2.0.5. The vulnerability stems from an incomplete character blocklist used to sanitize user-supplied commands before passing them to shell_exec(). Despite a prior fix (GHSA-9643-6xjp-vx57) that added the dollar sign to the blocklist, the characters pipe (|), backtick (`), and newline byte (0x0A) remained unblocked. An authenticated user with terminal permissions (enabled by default) can exploit these characters to bypass the TERMINAL_COMMANDS allowlist and execute arbitrary OS commands as the web server user. The flaw represents a security regression pattern where partial fixes leave residual attack vectors. The issue has been fully patched in version 2.0.6. Users are strongly advised to upgrade immediately to mitigate the risk of arbitrary command execution.