Detections
Analytics

SCA: security update for pheditor/pheditor (GHSA-9643-6xjp-vx57)

high Tenable Self-Hosted Container Security Plugin ID 444789

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an
 authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command
 starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to
 shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated user with the
 terminal permission can bypass a restricted command allowlist and execute arbitrary shell commands as the
 web server user. This issue has been patched in version 2.0.5. (CVE-2026-54540)

Solution

Update the pheditor/pheditor library and its related packages to version 2.0.5 or later.

See Also

https://github.com/advisories/GHSA-9643-6xjp-vx57

Plugin Details

Severity: High

ID: 444789

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/17/2026

Updated: 7/28/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54540

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/16/2026

Vulnerability Publication Date: 7/16/2026

Reference Information

CVE: CVE-2026-54540

cwe: CWE-78