CRITICALVulnerability
Verified
Global
NVD CRITICAL: CVE-2026-40044 — Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticate...
·Source: NIST NVD
Updated:
Executive Summary
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.
Analysis
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur. CVSS Score: 9.8. Published: 2026-04-13T19:16:52.290.