CVE-2026-40044: Pachno

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.

Affected products

• Pachno Pachno: version 1.0.6 only

Published 2026-04-13. Last modified 2026-06-17.