An unauthenticated deserialization vulnerability in Pachno 1.0.6 allows attackers to execute arbitrary code by injecting malicious objects into world-writable cache files.

The application unserializes data from world-writable cache files during the framework bootstrap process before any authentication checks occur. An unauthenticated attacker can exploit this by writing malicious serialized PHP objects to these predictable file paths, leading to remote code execution.

The CVSS score of 9.8 indicates a critical risk, as this vulnerability provides a direct vector for full server compromise. Successful exploitation grants the attacker the ability to execute commands with the privileges of the web server, leading to data exfiltration, system destruction, or further network penetration.

Immediate Action: Restrict write permissions on the directory containing the Pachno cache files to prevent unauthorized object injection.

Proactive Monitoring: Monitor the web server’s cache directory for the creation of unexpected files or modifications to existing files that do not correspond to legitimate application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in incoming requests.

Public Exploit Available: Unknown

This vulnerability is highly severe due to the ease of exploitation and the level of access granted. Administrators must immediately restrict file system permissions as an interim measure while awaiting an official vendor patch to address the underlying deserialization flaw.