Vulnerability · Published Apr 13, 2026 · Assigned by VulnCheck
CVE-2026-40040Pachno 1.0.6 Unrestricted File Upload Remote Code Execution
High 8.8
In plain English
A high-severity unrestricted file upload in Pachno from Pachno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 scripts to web-accessible directories and execute them to achieve remote code execution on the server.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Zero Science Lab Disclosure third-party-advisory
- VulnCheck Advisory: Pachno 1.0.6 Unrestricted File Upload Remote Code Execution third-party-advisory