What’s Vulnerable › Vulnerabilities

CVE-2026-40041: Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-13 · updated 2026-10-26
• Weakness: CWE-352

Description

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload, milestone editing, and administrative functions to force logout, create accounts, modify roles, inject comments, or upload files when authenticated users visit attacker-controlled websites.

Affected products

• Pachno: 1.0.6

References

• https://www.vulncheck.com/advisories/pachno-cross-site-request-forgery-via-state-changing-endpoints
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5983.php

Get alerted when CVE-2026-40041 or the next vulnerability affects your stack