← Advisories

Pachno 1.0.6 FileCache Deserialization Remote Code Execution

High
Advisory ID
ZSL-2026-5986
Release Date
12 April 2026
Vendor
Daniel André Eikeland - https://github.com/pachno/pachno
Affected Version
1.0.6
CVE
N/A
Tested On
GNU/Linux, Apache2, PHP/7.4, MySQL/5.7 (MariaDB)
Summary

Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking, and documentation. It offers a module-based, customizable environment for software development and team workflows, distributed under the Mozilla Public License.

Description

The application uses unserialize() function on the contents of cache files stored under {PACHNO_PATH}/cache/ during the framework bootstrap sequence, before any authentication, routing, or controller logic is executed. Cache files are created with world-writable permissions (chmod 0666) and use deterministic, predictable filenames derived from a small set of constants. An attacker who can write to the cache directory can inject a serialized PHP object payload that triggers arbitrary code execution on the next HTTP request.

Proof of Concept
Disclosure Timeline
06.04.2026Vulnerability discovered.
09.04.2026Vendor contacted.
11.04.2026No response from the vendor.
12.04.2026Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
N/A
Changelog
12.04.2026Initial release