PT-2026-32496 · Pachno · Pachno

Published 2026-04-13 · Updated 2026-04-14 · CVE-2026-40042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pachno version 1.0.6

Description An XML external entity injection allows unauthenticated attackers to read arbitrary files. This occurs due to unsafe XML parsing in the TextParser helper, where malicious XML entities can be injected through wiki table syntax and inline tags in issue descriptions, comments, and wiki articles. This triggers entity resolution via the simplexml load string() function without LIBXML NONET restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-403

Related Identifiers

CVE-2026-40042

Affected Products

Pachno

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-40042 · Security Note
• https://twitter.com/CVEnew/status/2043976218681151861 · Twitter Post
• https://twitter.com/OrizonCyber/status/2043841708073406693 · Twitter Post
• https://twitter.com/infoflowcloud/status/2043977951620825251 · Twitter Post
• https://vulncheck.com/advisories/pachno-wiki-textparser-xml-external-entity-injection · Note
• https://twitter.com/CveFindCom/status/2043777004265156806 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044097188410605607 · Twitter Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5984.php · Note