← Advisories

Pachno 1.0.6 (uploadfile) Unrestricted File Upload Remote Code Execution

High
Advisory ID
ZSL-2026-5982
Release Date
12 April 2026
Vendor
Daniel André Eikeland - https://github.com/pachno/pachno
Affected Version
1.0.6
CVE
N/A
Tested On
GNU/Linux, Apache2, PHP/7.4, MySQL/5.7 (MariaDB)
Summary

Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking, and documentation. It offers a module-based, customizable environment for software development and team workflows, distributed under the Mozilla Public License.

Description

The multipart file parameter to the /uploadfile endpoint allows authenticated users to upload files directly to the server. File upload must be enabled by an admin, who can also configure the storage path, within a web-accessible /public directory. Extension filtering is ineffective. Although a blacklist exists, it is never used (dead code), allowing arbitrary file types such as .php5 to be uploaded. Files are stored on disk regardless of permission checks. If the upload path is web-accessible, uploaded scripts can be executed, leading to remote code execution.

Proof of Concept
Disclosure Timeline
06.04.2026Vulnerability discovered.
09.04.2026Vendor contacted.
11.04.2026No response from the vendor.
12.04.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
N/A
Changelog
12.04.2026Initial release