by Kastro
Paper/Archive/CVE-2026-40042

CVE-2026-40042

Pachno Pachno — Pachno 1.0.6 Wiki TextParser XML External Entity Injection

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.3.313 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions, comments, and wiki articles to trigger entity resolution via simplexml_load_string() without LIBXML_NONET restrictions.

Affected

ProductAffectedFixed inSource
Pachno1.0.6–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupzeroscience.mk/en/vulnerabilities/ZSL-2026-5984.phpwriteupvulncheck.com/advisories/pachno-wiki-textparser-xml-external-entity-injection