Pachno EUVD-2026-22049

The vulnerability is exploitable when attackers can submit user-generated content that flows through Pachno's TextParser helper, specifically issue descriptions, comments, or wiki articles containing wiki table syntax or inline tags. Default Pachno 1.0.6 installations process this content through unsafe simplexml_load_string() calls. No special server configuration is required beyond standard Pachno deployment. Exploitation may require the ability to create issues, post comments, or edit wiki pages-access control varies by Pachno instance configuration. Instances with open registration, guest commenting, or public wikis present the highest risk. No special PHP configuration is needed to exploit; the vulnerability exists in application-level XML parsing logic.

Despite a critical CVSS 9.3 score (AV:N/AC:L/PR:N/UI:N with high confidentiality/integrity/availability impacts), real-world risk indicators suggest moderate priority. The EPSS score of 0.04% (14th percentile) indicates very low exploitation probability in the wild. No CISA KEV listing exists, confirming no confirmed active exploitation campaigns. Attack complexity is low and requires no authentication, making it trivial to exploit if Pachno instances are internet-facing. However, exploitation requires the attacker to inject content into wiki articles, issue descriptions, or comments-which may require some form of user registration or content submission capability depending on deployment configuration. The SSVC framework would likely classify this as 'attend' rather than 'act immediately' given: exploitation status (none), automatable (yes-simple XXE payloads), technical impact (total-file read can expose credentials). Priority depends heavily on whether Pachno instances are exposed to untrusted users and whether PHP/libxml configurations provide defense-in-depth. Organizations running Pachno 1.0.6 with open registration or public content submission should prioritize remediation.

An unauthenticated attacker visits a Pachno instance that allows public issue submission or wiki editing. They create a new issue or comment containing malicious wiki markup with embedded XXE payload, such as a table cell containing <!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]><root>&xxe;</root>. When the TextParser processes this content via simplexml_load_string() without LIBXML_NONET restrictions, the XML parser resolves the external entity and reads /etc/passwd. The attacker retrieves the file contents through error messages, response timing, or out-of-band exfiltration channels. This grants immediate access to sensitive configuration files, database credentials, or application source code.