EUVD-2026-22047Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges (PR:N); victim requires session and must visit malicious page (UI:R); scope changes as server acts under victim's identity (S:C); integrity-only impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload, milestone editing, and administrative functions to force logout, create accounts, modify roles, inject comments, or upload files when authenticated users visit attacker-controlled websites.
AnalysisAI
Cross-site request forgery in Pachno 1.0.6 allows unauthenticated attackers to force authenticated users into performing unintended state-changing actions - including account creation, role modification, file upload, comment injection, and forced logout - by luring victims to attacker-controlled webpages. The absence of CSRF token validation across multiple sensitive endpoints (login, registration, file upload, milestone editing, and admin functions) is the root cause. No active exploitation has been confirmed (SSVC: Exploitation=none, EPSS 0.01%, 3rd percentile), and real-world risk is constrained by the social-engineering dependency and Pachno's limited deployment footprint.
Technical ContextAI
Pachno is an open-source project management application identified by CPE cpe:2.3:a:pancho:pachno:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), a class of flaw in which web applications fail to verify that state-changing HTTP requests originate from the legitimate application UI rather than from third-party pages. Without synchronizer tokens, double-submit cookies, or SameSite cookie attributes, browsers will automatically attach session credentials to cross-origin POST requests, allowing attacker-crafted pages to impersonate authenticated users. The specific endpoints disclosed by ZeroScience (ZSL-2026-5983) include login, registration, file upload, milestone editing, and administrative role-management functions - a broad attack surface indicating systemic absence of CSRF controls rather than an isolated case.
RemediationAI
No vendor-released patch version has been identified in the available data from NVD, EUVD, or VulnCheck - patch availability should be verified directly with Pachno project maintainers. As a primary compensating control, administrators should implement CSRF token validation on all state-changing endpoints using the synchronizer token pattern or double-submit cookie method; this is the definitive fix class for CWE-352. If Pachno is deployed internally, restricting access to trusted network segments reduces the likelihood of cross-origin attack delivery. Enforcing the SameSite=Strict or SameSite=Lax attribute on Pachno session cookies (where configurable) will prevent browsers from attaching session cookies to cross-origin requests on modern browsers, providing meaningful mitigation without disabling functionality. Requiring re-authentication before sensitive admin actions (role assignment, account creation) limits blast radius even if a CSRF attempt succeeds. Technical disclosure is available at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5983.php.
Remote code execution in Pachno 1.0.6 allows unauthenticated attackers to achieve arbitrary code execution by exploiting
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read
Remote code execution in Pachno 1.0.6 allows authenticated users to upload and execute PHP5 scripts via the /uploadfile
Privilege escalation in Pachno 1.0.6 allows low-privilege authenticated users to hijack administrator sessions by manipu
Open redirection in Pachno 1.0.6's return_to parameter enables phishing campaigns that harvest user credentials by redir
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting
Stored cross-site scripting in Pachno 1.0.6 allows authenticated users to inject persistent malicious scripts through fi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today