PT-2026-32492 · Pachno · Pachno

Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-40038

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pachno version 1.0.6

Description A stored cross-site scripting issue allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. The flaw exists because of improper sanitization via Request::getRawParameter() or Request::getParameter() calls. Scripts can be injected through the value, comment body, article content, description, and message parameters across multiple controllers, which are then stored in the database and executed in users' browser sessions.

Recommendations As a temporary workaround, restrict or sanitize the use of the value, comment body, article content, description, and message parameters in POST requests until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40038

Affected Products

Pachno

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40038 · Security Note
• https://twitter.com/infoflowcloud/status/2043977947485192681 · Twitter Post
• https://twitter.com/CVEnew/status/2043976222426661354 · Twitter Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5980.php · Note
• https://vulncheck.com/advisories/pachno-stored-cross-site-scripting-via-multiple-parameters · Note