CVE-2026-40042

Pachno 1.0.6 is affected by an XML external entity (XXE) injection vulnerability in its TextParser helper component that allows unauthenticated attackers to read arbitrary files from affected systems. The vulnerability exists due to unsafe XML parsing via simplexml_load_string() without LIBXML_NONET restrictions, enabling malicious XML entity injection through wiki table syntax and inline tags embedded in issue descriptions, comments, and wiki articles. This is a critical vulnerability with a CVSS 3.1 score of 9.8, reflecting a network-based attack requiring no authentication or user interaction and presenting high impact across confidentiality, integrity, and availability. The attack has low complexity and can be executed remotely by any unauthenticated user, making it highly exploitable. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.0006 indicates this vulnerability is being exploited less frequently than most CVEs, and community attention remains limited as the issue has not reached active hot list status.