EUVD-2026-22041
GHSA-fpfp-p6p5-q4rm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requiring authenticated submission (PR:L) and victim page-load (UI:R); scope changes as payload executes in victim browser, yielding C:L and I:L on that context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. Attackers can inject scripts through the value, comment_body, article_content, description, and message parameters across multiple controllers, which are stored in the database and executed in users' browser sessions due to improper sanitization via Request::getRawParameter() or Request::getParameter() calls.
AnalysisAI
Stored cross-site scripting in Pachno 1.0.6 allows authenticated users to inject persistent malicious scripts through five POST parameters (value, comment_body, article_content, description, message) that are stored in the database and executed in victims' browsers upon page load. The vulnerability is systemic, rooted in insufficient sanitization within the Request::getRawParameter() and Request::getParameter() framework methods across multiple controllers rather than isolated field-level failures. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), with SSVC also rating exploitation as none - aligning signals indicate minimal active targeting at this time.
Technical ContextAI
Pachno is a web-based project management and issue-tracking application. The CPE identifier cpe:2.3:a:pancho:pachno:*:*:*:*:*:*:*:* places it in the application software category under vendor 'pancho'. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled input is accepted, stored persistently in the database, and later rendered into HTML responses without adequate output encoding, allowing injected script tags or event handlers to execute in the browser context of any user who views the affected content. The breadth of affected parameters - spanning comment bodies, article content, issue descriptions, field values, and messages - indicates the sanitization gap is at the framework Request class level (getRawParameter/getParameter), meaning any controller that reads user input through these methods and renders it without additional escaping inherits the vulnerability.
RemediationAI
No vendor-released patched version has been identified in any referenced source at time of analysis. Administrators should monitor the ZeroScience advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5980.php) and Pachno's release channel for a corrective update and apply it promptly when available. As compensating controls until a patch is released: deploy a Web Application Firewall rule targeting script injection patterns in the named POST parameters (value, comment_body, article_content, description, message), though WAF bypass is a known risk and this is not a substitute for patching. Implementing a strict Content Security Policy (CSP) header - specifically blocking inline script execution via 'script-src' without 'unsafe-inline' - significantly limits the damage of any executed payload by preventing exfiltration to attacker-controlled domains, but requires configuration at the reverse proxy or web server layer and may break legitimate Pachno UI functionality that relies on inline scripts. Restricting content-creation permissions to trusted users only directly removes the PR:L attack prerequisite and is the most operationally effective compensating control for instances with mixed user trust levels.
Remote code execution in Pachno 1.0.6 allows unauthenticated attackers to achieve arbitrary code execution by exploiting
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read
Remote code execution in Pachno 1.0.6 allows authenticated users to upload and execute PHP5 scripts via the /uploadfile
Privilege escalation in Pachno 1.0.6 allows low-privilege authenticated users to hijack administrator sessions by manipu
Open redirection in Pachno 1.0.6's return_to parameter enables phishing campaigns that harvest user credentials by redir
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting
Cross-site request forgery in Pachno 1.0.6 allows unauthenticated attackers to force authenticated users into performing
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today