Summary
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditor_password is enough to reach the password-change form, and submitting pheditor_new_password / pheditor_confirm_password in the same request is enough to set an arbitrary new password and obtain an authenticated session, without ever proving knowledge of the current password.
Root Cause
pheditor.php line 163:
if (PASSWORD == hash('sha512', 'admin')) { // still default, force change prompt
This checks whether the stored PASSWORD constant is still the default value. It does not check whether the submitted pheditor_password matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication.
PoC
TARGET="https://victim.com/pheditor.php"
# Any non-empty value works here, password is never actually verified
curl -c /tmp/j.txt \
-d 'pheditor_password=anything' \
-d 'pheditor_new_password=attacker123' \
-d 'pheditor_confirm_password=attacker123' \
"$TARGET" -L -s -o /dev/null
# Session is now authenticated as admin, with the password changed to attacker123
Note on scope
The original report submitted alongside this finding also included two additional items:
- Unrestricted PHP upload, addressed as intended behavior (Pheditor is a single-admin PHP file editor; PHP file creation/editing is core to its function, and pattern-restricting only the upload path doesn't reduce risk since the same result is reachable via the
save/newfileaction). Documented explicitly in the README's new Security Model section. - Terminal allowlist bypass (
php -r ...), a duplicate of a previously reported and already-patched issue (GHSA-g3hq-hphg-8fhh, fixed in v2.0.7).
This advisory has been scoped to the authentication bypass specifically, since it's a distinct root cause from both of those. Full responses to all three points are in the comments below.
Impact
On any instance where the default password has not yet been changed, an unauthenticated attacker can set an arbitrary new admin password and obtain a fully authenticated session, without knowing the current password. This is a complete authentication bypass, not merely "default credentials in use", it holds even if the operator believes the instance is protected because the login form is present.
GHSA-F25V-X6VR-962G has a CVSS score of 10.0 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.8); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Verify the submitted password against the stored PASSWORD constant before entering the forced password-change branch, so the flow is reachable only by someone who actually knows the current password:
$submitted_hash = hash('sha512', $_POST['pheditor_password']);
if (PASSWORD == hash('sha512', 'admin') && $submitted_hash === PASSWORD) {
// proceed to forced password-change flow
} else {
// treat as a normal login attempt (including rate-limiting)
}
Frequently Asked Questions
- What is GHSA-F25V-X6VR-962G? GHSA-F25V-X6VR-962G is a critical-severity security vulnerability in pheditor/pheditor (composer), affecting versions < 2.0.8. It is fixed in 2.0.8.
- How severe is GHSA-F25V-X6VR-962G? GHSA-F25V-X6VR-962G has a CVSS score of 10.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of pheditor/pheditor are affected by GHSA-F25V-X6VR-962G? pheditor/pheditor (composer) versions < 2.0.8 is affected.
- Is there a fix for GHSA-F25V-X6VR-962G? Yes. GHSA-F25V-X6VR-962G is fixed in 2.0.8. Upgrade to this version or later.
- Is GHSA-F25V-X6VR-962G exploitable, and should I be worried? Whether GHSA-F25V-X6VR-962G is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-F25V-X6VR-962G is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-F25V-X6VR-962G? Upgrade
pheditor/pheditorto 2.0.8 or later.