CVE-2026-40042: critical vulnerability in Pachno
Pachno 1.0.6 Wiki TextParser XML External Entity Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.4%
Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions, comments, and wiki articles to trigger entity resolution via simplexml_load_string() without LIBXML_NONET restrictions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Pachno · PachnoRelated CVEs — Pachno
In the same product, most dangerous first.
CVE-2026-40044CRITICALPachno 1.0.6 FileCache Deserialization Remote Code ExecutionEPSS 0.5%CVE-2026-40040HIGHPachno 1.0.6 Unrestricted File Upload Remote Code ExecutionEPSS 0.5%CVE-2026-40039HIGHPachno 1.0.6 Open Redirection via return_to ParameterEPSS 0.3%CVE-2026-40038MEDIUMPachno 1.0.6 Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%CVE-2026-40041MEDIUMPachno 1.0.6 Cross-Site Request Forgery via State-Changing EndpointsEPSS 0.1%