Pachno version 1.0.6 contains a deserialization flaw that permits attackers to inject malicious PHP object payloads into cache files. When the framework boots, these cache files are unserialized before any authentication checks are performed, allowing an unauthenticated attacker who can write to the world‑writable cache directory to execute arbitrary code on the host. This vulnerability is a classic example of CWE‑502 and can lead to full compromise of the affected system.

The listed vendor and product are pancho for Pachno, specifically the 1.0.6 release. No other vendors, products, or versions are indicated as impacted.

The score of 9.3 on the CVSS indicates a very high severity. Exploitation requires the attacker to obtain write access to cache files with predictable names in a directory that is world‑writable; once written, the payload is executed during bootstrap, before user authentication. Because the EPSS score is unavailable and the vulnerability is not in the KEV catalog, the precise likelihood of exploitation is unclear, but the high CVSS and the low barrier to writing files give attackers a straightforward path to compromise systems running this version.