Executive brief
Pachno, an open-source project management and collaboration platform, is vulnerable to a security flaw that allows unauthorized individuals to read sensitive files from the server. By submitting specially crafted content in areas like issue descriptions, comments, or wiki articles, an attacker can bypass security controls to access internal system data. This could lead to the exposure of configuration files, credentials, and other private information, potentially compromising the entire server.
Technical details
An XML External Entity (XXE) injection vulnerability exists in Pachno versions up to and including 1.0.6. The vulnerability is located in the TextParser helper component, which utilizes the PHP function simplexml_load_string() to process XML content without disabling external entity resolution (specifically lacking the LIBXML_NONET constant or equivalent protections). Attackers can exploit this by injecting malicious XML entities through wiki table syntax and inline tags within issue descriptions, comments, or wiki articles. Successful exploitation allows an unauthenticated remote attacker to perform arbitrary file disclosure from the underlying filesystem and potentially conduct Server-Side Request Forgery (SSRF).
Affected products
- Pachno Pachno <= 1.0.6
Timeline
- 2026-04-13: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
- 2026-04-13: advisory: CVE-2026-40042 published