CVE-2026-40041: falha de média gravidade em Pachno
Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.1%
Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload, milestone editing, and administrative functions to force logout, create accounts, modify roles, inject comments, or upload files when authenticated users visit attacker-controlled websites.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Produtos afetados
Pachno · PachnoCVEs relacionadas — Pachno
No mesmo produto, das mais perigosas para as menos.
CVE-2026-40044CRITICALPachno 1.0.6 FileCache Deserialization Remote Code ExecutionEPSS 0.5%CVE-2026-40040HIGHPachno 1.0.6 Unrestricted File Upload Remote Code ExecutionEPSS 0.5%CVE-2026-40042CRITICALPachno 1.0.6 Wiki TextParser XML External Entity InjectionEPSS 0.4%CVE-2026-40039HIGHPachno 1.0.6 Open Redirection via return_to ParameterEPSS 0.3%CVE-2026-40038MEDIUMPachno 1.0.6 Stored Cross-Site Scripting via Multiple ParametersEPSS 0.2%