CVE-2026-48030: Critical OS Command Injection in Pheditor via Unsanitized 'dir' Parameter

Vulnerability Overview

CVE-2026-48030 is a critical OS command injection vulnerability (CWE-78, CVSS 9.9) in Pheditor, a PHP-based code editor. The root cause is straightforward but severe: the application's terminal handler accepts a dir parameter from user-supplied input and passes it directly to a shell command without sanitisation or escaping. This allows an attacker to inject arbitrary shell metacharacters and execute any OS command in the context of the web server process.

The impact is full remote code execution on the hosting server. Because the flaw sits in a terminal handler, successful exploitation grants the attacker an effective interactive shell primitive — file reads, lateral movement, persistence, and data exfiltration are all within reach from a single request.

Affected Software

• Vendor: Composer package pheditor/pheditor
• Affected versions: 2.0.1 through 2.0.3 (inclusive)
• Patched version: No patch available as of disclosure (2026-06-09)

Any internet-exposed or internally accessible Pheditor instance running versions 2.0.1–2.0.3 should be considered compromised until mitigated. There is currently no vendor-released fix; the recommended mitigation is to remove or restrict access to the application immediately.

Exploitation Status

A public proof-of-concept (PoC) exists for this vulnerability, raising the probability of active in-the-wild exploitation significantly. The barrier to exploitation is low — the injection point is in a publicly reachable handler, and the PoC reduces the technical skill required to near zero. Defenders should treat this as actively exploited until evidence suggests otherwise and prioritise detection and containment accordingly.

How Our Detection Catches It

Our detection coverage targets the observable artefacts of exploitation across the full SIEM stack. The core detection logic looks for anomalous process execution patterns spawned from a web server context — specifically, child processes of web server or PHP interpreter processes that match command injection payloads, including shell metacharacter sequences and suspicious argument patterns associated with the dir parameter abuse.

We ship purpose-built queries for seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates process creation events from web server parent processes with known injection indicators
• Splunk (SPL) — searches process and web access logs for shell execution chains originating from the Pheditor terminal endpoint
• Elastic (EQL) — uses sequence detection to link HTTP requests to the vulnerable handler with downstream OS process spawning
• IBM QRadar (AQL) — queries flow and event data for web-to-shell execution patterns
• Sumo Logic — targets application and endpoint telemetry for injection-characteristic process trees
• Chronicle (YARA-L) — hunts process and HTTP metadata for the exploitation signature
• CrowdStrike (CQL) — leverages endpoint telemetry to catch the shell execution at the process level with high fidelity

Because no patch exists, detections are your primary defensive control. Pair them with network-layer restrictions (allowlisting, WAF rules blocking shell metacharacters in the dir parameter) and consider taking exposed Pheditor instances offline.

Full Detection

The complete KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL queries — along with triage guidance and atomic test mappings — are available on the CVE-2026-48030 detection page. Free-tier users can access the query logic directly; purple team playbooks and adversary simulation tests are available to paid subscribers.