VulnSocial

CVE-2026-48030Disclosure

LOWCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-28); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-27: 1Mentions · 2026-07-28: 2Mentions · 2026-08-08: 1PoC Mentioned / Linked · 2026-07-28: 1Technical Details · 2026-07-27: 1Technical Details · 2026-07-28: 1Technical Details · 2026-08-08: 107-2707-2808-08
Signal classification3 categories
Disclosure
250.0%
General
125.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-271
Disclosure1
2026-07-282
General1PoC1
2026-08-081
Disclosure1
Full discourse4 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-48030 - critical 🚨 Pheditor 2.0.1-2.0.3 - OS Command Injection > Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitiz... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-48030 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces CVE-2026-48030 as a critical OS command injection in Pheditor 2.0.1‑2.0.4, providing technical details but no PoC, patch, or evidence of exploitation.

    01032431
    1.3K followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-11756 CVE-2026-16812 CVE-2026-48030 CVE-2026-15014 CVE-2026-51303 ..🧵👇

    Post summary

    The post serves as a concise daily list of CVE identifiers without further technical or actionable information.

    1102033
    27 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [CVE] CVE-2026-48030 [HIGH PRIORITY] #Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' para... 🔗 https://exploitgrid.net/cve/CVE-2026-48030

    Post summary

    CVE-2026-48030 is an OS Command Injection vulnerability in Pheditor's terminal handler caused by unsanitized 'dir' parameters, with a PoC available at exploitgrid. No active exploitation or patch information is disclosed.

    1000019
    28 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48030 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal ac… https://www.cve.org/CVERecord?id=CVE-2026-48030

    Post summary

    The text announces an OS Command Injection vulnerability in Pheditor versions 2.0.1–2.0.3, providing technical details and a link to the CVE record.

    00000734
    57.9K followersView on X

Explore more

Back to dashboard