{"answers":{"affected":"2 open source packages ship an affected version, including pheditor/pheditor.","exploited":"There is no known exploitation of GHSA-f25v-x6vr-962g in the wild and no public exploit code.","fix":"Upgrade pheditor/pheditor to 2.0.8 or later.","what":"GHSA-f25v-x6vr-962g is an authentication bypass vulnerability in pheditor/pheditor, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-f25v-x6vr-962g and fix it if it is affected.\n\nWhat it is: GHSA-f25v-x6vr-962g is an authentication bypass vulnerability in pheditor/pheditor, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-f25v-x6vr-962g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pheditor/pheditor (Packagist): affected all versions; fixed in 2.0.8\n- pheditor/pheditor (Packagist): affected all versions; fixed in 2.0.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-f25v-x6vr-962g/ (Markdown: https://insights.sbomify.com/GHSA-f25v-x6vr-962g/index.md)","id":"GHSA-f25v-x6vr-962g","markdown":"https://insights.sbomify.com/GHSA-f25v-x6vr-962g/index.md","name":"GHSA-f25v-x6vr-962g","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["privilege_escalation","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Pheditor web editor","requires_auth":"none","summary":"Unauthenticated attackers can bypass authentication and take over admin accounts by exploiting a flaw in the forced password-change flow that fails to verify the current password.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nThe forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in `pheditor_password` is enough to reach the password-change form, and submitting `pheditor_new_password` / `pheditor_confirm_password` in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password.\n\n## Root Cause\n\n`pheditor.php` line 163:\n\n```php\nif (PASSWORD == hash('sha512', 'admin')) { // still default — force change prompt\n```\n\nThis checks whether the **stored** `PASSWORD` constant is still the default value. It does not check whether the **submitted** `pheditor_password` matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication.\n\n## PoC\n\n```bash\nTARGET=\"https://victim.com/pheditor.php\"\n\n# Any non-empty value works here — password is never actually verified\ncurl -c /tmp/j.txt \\\n  -d 'pheditor_password=anything' \\\n  -d 'pheditor_new_password=attacker123' \\\n  -d 'pheditor_confirm_password=attacker123' \\\n  \"$TARGET\" -L -s -o /dev/null\n\n# Session is now authenticated as admin, with the password changed to attacker123\n```\n\n## Impact\n\nOn any instance where the default password has not yet been changed, an unauthenticated attacker can set an arbitrary new admin password and obtain a fully authenticated session, without knowing the current password. This is a complete authentication bypass, not merely \"default credentials in use\" — it holds even if the operator believes the instance is protected because the login form is present.\n\n## Remediation\n\nVerify the submitted password against the stored `PASSWORD` constant *before* entering the forced password-change branch, so the flow is reachable only by someone who actually knows the current password:\n\n```php\n$submitted_hash = hash('sha512', $_POST['pheditor_password']);\n\nif (PASSWORD == hash('sha512', 'admin') \u0026\u0026 $submitted_hash === PASSWORD) {\n    // proceed to forced password-change flow\n} else {\n    // treat as a normal login attempt (including rate-limiting)\n}\n```\n\n## Note on scope\n\nThe original report submitted alongside this finding also included two additional items:\n\n- **Unrestricted PHP upload** — addressed as intended behavior (Pheditor is a single-admin PHP file editor; PHP file creation/editing is core to its function, and pattern-restricting only the upload path doesn't reduce risk since the same result is reachable via the `save`/`newfile` action). Documented explicitly in the README's new Security Model section.\n- **Terminal allowlist bypass (`php -r ...`)** — a duplicate of a previously reported and already-patched issue (GHSA-g3hq-hphg-8fhh, fixed in v2.0.7).\n\nThis advisory has been scoped to the authentication bypass specifically, since it's a distinct root cause from both of those. Full responses to all three points are in the comments below.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password","id":"GHSA-f25v-x6vr-962g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["2.0.8"],"introduced":["0"],"last_affected":[],"package":"pheditor/pheditor","purl":null,"source":"GHSA-f25v-x6vr-962g"},{"ecosystem":"Packagist","fixed":["2.0.8"],"introduced":["0"],"last_affected":[],"package":"pheditor/pheditor","purl":"pkg:composer/pheditor/pheditor","source":"GHSA-f25v-x6vr-962g"}],"products":null,"published":"2026-07-24","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can bypass authentication and take over admin accounts by exploiting a flaw in the forced password-change flow that fails to verify the current password.","url":"https://insights.sbomify.com/GHSA-f25v-x6vr-962g/"}