CVE-2026-40042: Pachno 1.0.6 XML External Entity Injection in TextParser
Pachno 1.0.6 contains an XML external entity injection flaw in its TextParser helper that the record says can be reached without authentication. The record describes arbitrary file read as the impact, with a CVSS 3.1 base score of 9.8 (critical). No confirmed exploitation appears in the sources consulted and the CVE is not listed in CISA KEV.
Overview
Pachno 1.0.6 is affected by an XML external entity (XXE) injection flaw in its TextParser helper. According to the record, wiki content such as issue descriptions, comments and wiki articles is parsed as XML in a way that allows external entity resolution.
Impact
- The record states that unauthenticated attackers can read arbitrary files.
- The CVSS 3.1 vector in the record indicates network attack vector, low complexity, no privileges required and no user interaction, with high confidentiality, integrity and availability impact. The base score is 9.8.
- Inference: the practical impact depends on which files the application process can read and what content is returned to the requester.
Affected products and versions
- The description identifies Pachno 1.0.6. The record does not list affected version ranges and does not list fixed versions.
- A missing fixed version in the record does not mean no fix exists. Check the vendor and the referenced advisories.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The record includes an EPSS probability of 0.00622 with a percentile of 0.4845.
Remediation and mitigation
- Identify all Pachno deployments and check the vendor or the referenced advisories for an updated release.
- Until a fix is applied, limit exposure of wiki and issue features to trusted users where practical, and review file system permissions for the application account so that sensitive files are not readable by it.
- As a code review item, review how XML parsing is configured in the application, since the record indicates that network access restrictions for entity resolution are not in place.
Detection guidance
- Review web and application logs for unusual wiki or issue submissions that contain XML markup or entity declarations.
- Monitor the application server for unexpected outbound network connections, which may indicate external entity resolution.
- Watch for application responses that contain unexpected file contents.
Limitations of the available information
- The record has no title, no affected version range, no fixed version and no CWE name. The listed CWE is CWE-403, which should be reviewed against the XXE description.
- The CVSS 4.0 score of 9.3 from the CNA is recorded without a vector string.
- The record does not describe vendor response or patch availability.
Frequently asked questions
What is the main risk of this Pachno vulnerability?
According to the record, unauthenticated attackers can read arbitrary files on the server through an XML external entity injection in the TextParser helper. The CVSS 3.1 base score in the record is 9.8.
Is this CVE known to be actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and is there a fix?
The description identifies Pachno 1.0.6. The record lists no affected ranges and no fixed versions, so the vendor and referenced advisories should be checked for an update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.