CVE-2026-55579
CVE-2026-55579 · Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.
CVSS 9.8 · Critique · EPSS 0,8% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
pheditor
- Versions du logiciel
- >= 2.0.1, < 2.0.6: Concernée
Aucun correctif publié
pheditor/pheditor Packagist
- Versions du logiciel
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- Plages de versions concernées
- ECOSYSTEM: ≥ 2.0.1, < 2.0.6
Mettez à jour vers 2.0.6