Pheditor's terminal feature restricts commands to an allowlist using a prefix match without validating arguments. The allowlist includes binaries such as find, git, php, tar, and grep, which can execute arbitrary commands via their options. The code rejects shell metacharacters but does not reject spaces or flags that enable command execution. Commands are executed through shell_exec without argument sanitization, allowing attackers to bypass restrictions by crafting commands that start with an allowlisted binary and include malicious arguments. This vulnerability is distinct from prior metacharacter injection issues and results in arbitrary command execution for users with terminal permission. The default deployment's hardcoded admin password further increases exposure.

Allows arbitrary command execution on the host with the web server's privileges by users with terminal permission. Due to a hardcoded default admin password with no forced change, attackers can gain authenticated access easily, effectively enabling unauthenticated remote code execution. This can lead to full system compromise depending on the web server's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigations include validating the full command and its arguments rather than just the prefix, rejecting dangerous flags for allowlisted binaries, running commands as argv arrays through a restricted launcher without a shell, or removing binaries capable of code execution from the allowlist. Until an official fix is available, avoid enabling the terminal feature or restrict terminal permissions to trusted users only.