CVE-2026-55579: Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

July 16, 2026

Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution.

References

github.com/advisories/GHSA-p4h7-p9rj-2pq2
github.com/pheditor/pheditor/releases/tag/2.0.6
github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2
nvd.nist.gov/vuln/detail/CVE-2026-55579

Code Behaviors & Features

Detect and mitigate CVE-2026-55579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →