CVE-2026-55579
Received Received - Intake

Hard-Coded Admin Credentials in Pheditor PHP Editor

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-55579
EUVD
EUVD-2026-49387

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55579 is a critical vulnerability in Pheditor, a PHP-based single-file editor and file manager. The issue involves a hardcoded default password 'admin' stored as an unsalted SHA-512 hash in the source code. Versions 2.0.1 to 2.0.5 are affected, and there is no mechanism to force users to change this password on first login. This allows unauthenticated attackers to gain full administrative access, including file read/write, file uploads, and terminal access, enabling arbitrary command execution and remote code execution.

Detection Guidance

Check if Pheditor versions 2.0.1 to 2.0.5 are installed by inspecting the pheditor.php file for a hardcoded SHA-512 hash of 'admin' at line 11. Search for the string 'admin' in the file to confirm presence of default credentials.

Impact Analysis

This vulnerability allows attackers to gain full control over the Pheditor application. They can read, modify, or delete files, upload malicious files, and execute arbitrary commands on the server. Since the default password is hardcoded and easily guessable, any deployment using the default credentials is at high risk of compromise. The impact includes potential data breaches, system takeover, and further lateral movement within the network.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. A breach via this vulnerability could result in unauthorized data exposure, leading to legal penalties, fines, and reputational damage for organizations failing to secure their systems.

Mitigation Strategies

Upgrade Pheditor to version 2.0.6 or later immediately. Remove the hardcoded password from pheditor.php and enforce a password change on first login. Implement secure password hashing and block unsafe characters in terminal commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart