Executive brief
Pachno, an open-source project management and collaboration platform, contains a security flaw that allows registered users to upload malicious files. By bypassing the system's file filters, an attacker can upload and run custom scripts on the server. This could lead to a total takeover of the application, allowing the attacker to steal sensitive data, modify content, or disrupt business operations.
Technical details
An unrestricted file upload vulnerability exists in Pachno version 1.0.6 and potentially earlier versions. The flaw is located in the `/uploadfile` endpoint, which employs ineffective file extension filtering. An authenticated attacker can bypass these checks to upload arbitrary files, such as `.php5` scripts, to web-accessible directories. Once uploaded, these scripts can be executed by the server, leading to Remote Code Execution (RCE). This allows the attacker to perform actions with the privileges of the web server user, compromising the confidentiality, integrity, and availability of the host.
Affected products
- Pachno Pachno 1.0.6 and earlier
Timeline
- 2026-04-13: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
- 2026-04-13: advisory: CVE-2026-40040 published