Executive brief
Pachno, an open-source collaboration and project management platform, contains a critical security flaw that allows unauthorized individuals to take complete control of the server. By placing specially crafted files into a publicly accessible temporary storage area, an attacker can force the system to execute malicious code before it even asks for a login. This could result in the theft of sensitive project data, total service disruption, or the use of the server to launch further attacks.
Technical details
A deserialization vulnerability exists in Pachno 1.0.6 due to the insecure handling of cache files during the framework bootstrap process. The application utilizes a file-based caching mechanism where cache files are stored with predictable names in a world-writable directory. An unauthenticated attacker can write a malicious PHP serialized object payload into these cache files; when the framework initializes, it unserializes these files before performing authentication checks. This leads to remote code execution (RCE) via PHP object injection. The vulnerability is tracked as CVE-2026-40044 and affects all versions up to and including 1.0.6.
Affected products
- Pachno Pachno 1.0.6 and earlier
Timeline
- 2026-04-13: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
- 2026-04-13: advisory: CVE-2026-40044 published