Pheditor hardcoded admin RCE (CVE-2026-55579) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-55579 is a critical unauthenticated remote code execution in Pheditor 2.0.1 through 2.0.5 that grants full file system access and command execution to any attacker who logs in with the default admin credentials. Patched in version 2.0.6 - update immediately.

Overview

Pheditor is a single-file PHP editor and file manager designed for lightweight server administration. CVE-2026-55579 arises from a hardcoded default password (admin) whose SHA-512 hash is stored directly in pheditor.php at line 11. From version 2.0.1 to before version 2.0.6, there is no mechanism to force a password change on first login, meaning any deployment left at defaults is immediately accessible to anyone who knows the credentials.

The vulnerability carries a CVSS score of 9.8 (Critical) with a network attack vector, low complexity, and no required authentication or user interaction. This effectively makes it a zero-effort exploit for attackers scanning the internet for exposed Pheditor instances.

Impact

An attacker logging in with the default admin password gains access to three dangerous capabilities within Pheditor:

• File editor - read, write, and modify any file on the server accessible to the web server user.
• File upload - upload arbitrary files, including PHP shells, to the web root.
• Terminal feature - execute arbitrary system commands directly via the browser interface.

Combined, these features enable full server compromise. An attacker can exfiltrate databases, install malware, pivot to other internal systems, or use the compromised host as part of a botnet. The absence of forced password rotation means affected deployments remain vulnerable until an administrator manually changes the password or applies the patch.

Remediation

Upgrade Pheditor to version 2.0.6 or later, which removes the hardcoded default password and enforces a password setup on first run. For deployments that cannot upgrade immediately:

1. Manually change the admin password via the Pheditor settings panel.
2. Restrict network access to Pheditor using a firewall or reverse proxy (e.g., only allow trusted IPs).
3. Review server logs for any unauthorized logins from the default credentials.

Security Insight

CVE-2026-55579 is a textbook example of why default credentials remain one of the most avoidable yet persistent vulnerability classes. The fact that Pheditor ships with a hardcoded hash - effectively guaranteeing the same password on every installation - suggests a development process that never considered deployment security as a design requirement. This mirrors past incidents with IoT devices and network appliances that shipped with admin/admin credentials, underscoring that open source projects with small user bases face the same risks as enterprise hardware. For threat intelligence teams, this vulnerability highlights the value of scanning for exposed management interfaces using known default credentials, as such discoveries often yield high-value initial access without requiring any exploit development.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs