An OS command injection vulnerability in pheditor allows authenticated users to execute arbitrary commands on the underlying host with web server privileges.

This vulnerability involves improper neutralization of shell metacharacters in the dir POST parameter. An authenticated user can bypass the existing command whitelist to execute arbitrary OS commands.

With a CVSS score of 9.9, this vulnerability allows for full remote code execution, granting the attacker the same permissions as the web server user. This could lead to a complete system takeover, unauthorized access to local files, and lateral movement within the network.

Immediate Action: Update pheditor to version 2.0.4 or later immediately.

Proactive Monitoring: Audit server logs for unauthorized command execution or unexpected shell activity initiated by the web server process.

Compensating Controls: Restrict access to the management interface to trusted IP addresses and ensure the application runs with the minimum necessary OS privileges.

Public Exploit Available: No

This vulnerability presents an extreme risk to the host system. All administrators running affected versions of pheditor must upgrade to version 2.0.4 immediately to eliminate the possibility of remote code execution.