Pachno 1.0.6 includes an unrestricted file upload flaw where authenticated users can bypass the extension check on the /uploadfile endpoint and upload arbitrary files. The flaw is a CWE‑434 vulnerability that allows attackers to place executable .php5 scripts in web‑accessible directories and run them, giving remote code execution on the server.

The vulnerability affects the Pachno project management application, version 1.0.6.

The CVSS score is 8.7, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the upload endpoint and the ability to upload files. Since the upload path is web‑servable, an attacker who authenticates can upload a malicious script and execute it, leading to server compromise. The lack of mitigation in the current version means the risk is high for any instance that uses the default upload behavior.