CVE-2026-40044: Pachno 1.0.6 PHP Unsafe Deserialization via File Cache Leading to Remote Code Execution
Pachno 1.0.6 is reported to contain a deserialization flaw (CWE-502) in which cache files with predictable names and world-writable permissions can carry PHP object payloads that are unserialized during framework bootstrap, before authentication. The CVSS 3.1 base score of 9.8 is listed with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the record contains no affected or fixed version data.
Overview
CVE-2026-40044 is described as a deserialization vulnerability (CWE-502, Deserialization of Untrusted Data) in Pachno 1.0.6. According to the record, cache files in the cache directory use predictable names and are writable by all users, and their contents are unserialized during framework bootstrap before authentication checks run.
Impact
- The record describes arbitrary code execution by unauthenticated attackers.
- The CVSS 3.1 vector reported by the CNA (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a 9.8 base score, indicating high confidentiality, integrity and availability impact over the network.
- A CVSS 4.0 score of 9.3 is also listed by the same provider.
Affected products and versions
- The record identifies Pachno 1.0.6 as the affected version.
- The record does not include structured affected or fixed version ranges. Whether other versions are affected is unknown from the available data.
Exploitation status
- CISA KEV does not list this CVE in the record.
- No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00882 (percentile 0.58083), which estimates likelihood of exploitation and does not confirm activity.
Remediation and mitigation
- No vendor fix is provided in the record. The absence of fixed-version data does not mean no fix exists; administrators should check the vendor and the advisories listed below.
- Restrict write access to the cache directory so that only the application service account can write to it, and avoid world-writable permissions.
- Review how the application stores and loads cache files, and consider moving cache storage to locations that are not web-accessible or shared.
- Isolate the instance and limit network exposure until a verified update or mitigation is confirmed by the vendor.
Detection guidance
- Audit the cache directory for files with unexpected names, unexpected ownership, or permissions that allow writes by other users.
- Monitor file system changes in the cache directory and alert on new or modified cache files outside normal application activity.
- Review web server and application logs for unusual requests around the time cache files change.
Limitations of the available information
- The record has a null title and no affected or fixed version data.
- Technical details beyond the description are only available in the referenced advisories, which were not reviewed for this summary.
- The cache file naming scheme and exact vulnerable code path are not specified in the record.
- Analysis is limited to the data in the record.
Frequently asked questions
What is CVE-2026-40044?
It is a reported deserialization vulnerability (CWE-502) in Pachno 1.0.6 in which cache files can carry malicious serialized PHP objects that are processed before authentication.
Is this CVE being actively exploited?
CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record names Pachno 1.0.6. No structured affected or fixed version ranges are provided, so other versions are unknown.
What should administrators do now?
Restrict write access to the cache directory, review how cache files are loaded, limit network exposure, and check the vendor advisories for an update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.