CVE-2026-40041: medium-severity vulnerability in Pachno
Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.1%
Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload, milestone editing, and administrative functions to force logout, create accounts, modify roles, inject comments, or upload files when authenticated users visit attacker-controlled websites.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Affected products
Pachno · PachnoRelated CVEs — Pachno
In the same product, most dangerous first.
CVE-2026-40044CRITICALPachno 1.0.6 FileCache Deserialization Remote Code ExecutionEPSS 0.5%CVE-2026-40040HIGHPachno 1.0.6 Unrestricted File Upload Remote Code ExecutionEPSS 0.5%CVE-2026-40042CRITICALPachno 1.0.6 Wiki TextParser XML External Entity InjectionEPSS 0.4%CVE-2026-40039HIGHPachno 1.0.6 Open Redirection via return_to ParameterEPSS 0.3%CVE-2026-40038MEDIUMPachno 1.0.6 Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%