What’s Vulnerable › Vulnerabilities

CVE-2026-40044: Pachno 1.0.6 FileCache Deserialization Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-13 · updated 2026-10-25
• Weakness: CWE-502

Description

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.

Affected products

• Pachno: 1.0.6

References

• https://www.vulncheck.com/advisories/pachno-filecache-deserialization-remote-code-execution
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5986.php

Get alerted when CVE-2026-40044 or the next vulnerability affects your stack