CVE-2026-48030: Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter

June 9, 2026

An OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the ‘dir’ POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges.

References

github.com/advisories/GHSA-jvc5-6g7q-c843
github.com/pheditor/pheditor/commit/62b43df7cb8956a9b0deb9bec278ca8676c890c5
github.com/pheditor/pheditor/security/advisories/GHSA-jvc5-6g7q-c843
nvd.nist.gov/vuln/detail/CVE-2026-48030

Code Behaviors & Features

Detect and mitigate CVE-2026-48030 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →