CVE-2026-55579

CRITICAL 9.8

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.

CWE	CWE-798
Vendor	pheditor
Product	pheditor
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for pheditor pheditor

Be the first to know when new critical vulnerabilities affecting pheditor pheditor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

pheditor / pheditor

>= 2.0.1, < 2.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2 github.com: https://github.com/pheditor/pheditor/releases/tag/2.0.6