An unrestricted file upload vulnerability in Pachno 1.0.6 allows authenticated attackers to execute arbitrary code on the host server, posing a high risk to system integrity.

This is an unrestricted file upload flaw (CWE-434) located at the /uploadfile endpoint. Authenticated users can bypass extension filtering to upload executable scripts, such as .php5 files, to web-accessible directories.

The ability to execute arbitrary code on the server represents a critical security compromise, as it grants an attacker full control over the application environment. With a CVSS score of 8.8, this vulnerability carries a high risk of data exfiltration, service disruption, and unauthorized lateral movement within the network.

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict access to the /uploadfile endpoint and implement strict server-side validation of all uploaded file types.

Proactive Monitoring: Review web server access logs for suspicious requests to the upload directory and monitor for the creation of unauthorized executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing non-permitted file extensions or unexpected content types directed at the upload interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ZSL-2026-5982 research writeup.

Given the potential for remote code execution, organizations should treat this vulnerability with high priority. Users must audit their environment for the presence of Pachno 1.0.6 and apply restrictive access controls to the vulnerable endpoint until a formal security update is provided by the vendor.