Pheditor versions 2.0.1 to 2.0.5 are vulnerable to unauthorized access and remote code execution due to the presence of hardcoded default credentials.

This vulnerability involves the use of hardcoded credentials (admin/SHA-512) within the application code. An unauthenticated attacker can leverage these credentials to bypass authentication and gain full control over the file editor, file upload, and terminal features.

Successful exploitation grants an attacker complete control over the host environment. This leads to arbitrary file read and write capabilities and remote code execution, effectively resulting in a full system compromise. Given the CVSS score of 9.8, this vulnerability represents a critical risk to data confidentiality, integrity, and availability.

Immediate Action: Update the pheditor application to version 2.0.6 or later immediately.

Proactive Monitoring: Monitor server access logs for anomalous login attempts or unauthorized modifications to sensitive configuration files.

Compensating Controls: If an immediate update is not possible, restrict access to the pheditor instance at the network level using IP whitelisting or place the application behind a Web Application Firewall to block unauthorized access attempts.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

This vulnerability is severe and poses an immediate threat to any environment running an affected version of pheditor. Organizations must prioritize upgrading to version 2.0.6 to eliminate the hardcoded credential risk. Failure to remediate could result in a total system takeover by unauthorized parties.