Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pheditor/pheditor | composer | >= 2.0.1, <= 2.0.3 | 2.0.4 |
Miggo AIRoot Cause AnalysisThe analysis of the provided vulnerability information and the associated patch clearly indicates a command injection vulnerability in pheditor.php. The vulnerability is located in the code block that handles the 'terminal' action. The dir parameter, received from a POST request, is used to construct a command string that is executed via shell_exec. The original code did not sanitize the $dir variable, making it possible to inject arbitrary commands. The patch confirms this by adding escapeshellarg() to the $dir variable. The vulnerable function is identified as shell_exec because that is the function that executes the injected command, and it would appear in a runtime profile during exploitation. The vulnerability is not in a user-defined function but in the main script body, which calls the built-in shell_exec function.
shell_execpheditor.php