Threats affecting pkg:npm/pancho/pachno

Pachno version 1.0.6 has an unrestricted file upload vulnerability that allows authenticated users to bypass extension filtering on the /uploadfile endpoint. This enables uploading of executable files such as . php5 scripts to web-accessible directories, potentially leading to remote code execution on the server. The vulnerability has a high severity score of 8.7 but no confirmed patch or official remediation guidance is currently available.

Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.