CVE-2026-40042

The vulnerability results from unsafe XML parsing in the TextParser helper class, which calls the simplexml_load_string() function without the LIBXML_NONET flag, enabling resolution of external XML entities. An attacker can inject malicious XML entities through wiki table syntax and inline tags placed in issue descriptions, comments, or wiki articles. After the malicious XML document is processed by the parser, the server resolves external entities and exposes the contents of local system files.

An attacker without any authentication can read any files accessible to the web server process, including configuration files containing credentials, private keys, or other sensitive information. Successful exploitation of this vulnerability can lead to further system compromise.

Patches available from the vendor should be applied according to the references. As a temporary workaround, it is recommended to restrict access to the Pachno interface only to trusted users and ensure that the server configuration minimizes PHP process privileges to the file system.

Pachno version 1.0.6