XML External Entity Injection in Pachno 1.0.6 by Pachno
CVE-2026-40042

9.3CRITICAL

Key Information:

Vendor

Pancho

Status
Pachno
Vendor
CVE Published:
13 April 2026

What is CVE-2026-40042?

The Pachno 1.0.6 release contains a vulnerability allowing unauthenticated users to exploit unsafe XML parsing via the TextParser helper. This vulnerability enables attackers to perform XML external entity injection, allowing unauthorized access to arbitrary files. By crafting malicious XML entities through wiki table syntax and inline tags in issue descriptions, comments, and wiki articles, attackers can trigger unsafe entity resolution using simplexml_load_string(). This poses significant risks of data exposure, necessitating immediate protective measures.

Affected Version(s)

Pachno 1.0.6

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-59...
third-party-advisory
https://www.vulncheck.com/advisories/pachno-wiki-textpars...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
.