← Advisories

Pachno 1.0.6 (return_to) Open Redirection

Medium
Advisory ID
ZSL-2026-5981
Release Date
12 April 2026
Vendor
Daniel André Eikeland - https://github.com/pachno/pachno
Affected Version
1.0.6
CVE
N/A
Tested On
GNU/Linux, Apache2, PHP/7.4, MySQL/5.7 (MariaDB)
Summary

Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking, and documentation. It offers a module-based, customizable environment for software development and team workflows, distributed under the Mozilla Public License.

Description

Input passed via the return_to GET/POST parameter to the login endpoint is not properly verified before being used to redirect users. The _getLoginForwardUrl() helper applies htmlentities() to the value which is intended for HTML output encoding and does not validate URL schemes or hosts, and then issues a Location header with the unmodified URL. This can be exploited to redirect a user to an arbitrary external website and conduct phishing attacks.

Proof of Concept
Disclosure Timeline
06.04.2026Vulnerability discovered.
09.04.2026Vendor contacted.
11.04.2026No response from the vendor.
12.04.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
N/A
Changelog
12.04.2026Initial release