Pachno CVE-2026-40040

Attackers must possess valid authenticated credentials to Pachno 1.0.6 with permissions to access the /uploadfile endpoint functionality. The web server must be configured to process alternative PHP extensions (.php5) as executable scripts through handlers like AddHandler application/x-httpd-php5 .php5 in Apache configurations or equivalent FastCGI/PHP-FPM mappings in nginx. Uploaded files must be stored in web-accessible directories where HTTP requests can directly invoke them rather than download-only locations. The vulnerability does not require administrative privileges-standard user accounts with file upload capabilities are sufficient.

The CVSS 4.0 score of 8.7 reflects high potential impact (VC:H/VI:H/VA:H) with network accessibility (AV:N), low complexity (AC:L), and no user interaction required (UI:N). However, the PR:L requirement means attackers need valid user credentials, reducing the immediate attack surface compared to unauthenticated RCE. The EPSS score of 0.10% (27th percentile) indicates relatively low predicted exploitation probability in the wild, likely because the vulnerability requires authentication and targets a specific collaboration platform with limited market penetration. No CISA KEV listing exists, confirming no widespread active exploitation at time of analysis. SSVC framework assessment: exploitation status shows public advisories available (VulnCheck, Zero Science Labs) but no confirmed POC code or active campaigns; automatable potential is moderate given authentication requirements; technical impact is total system compromise. Real-world risk is elevated for organizations running Pachno 1.0.6 with multiple user accounts, but significantly lower than unauthenticated RCE vulnerabilities. Priority should focus on instances exposed to untrusted users or integrated with other authentication systems where credential compromise is more likely.

An attacker with valid low-privilege credentials (such as a standard project member account) authenticates to Pachno 1.0.6 and navigates to the file upload functionality at /uploadfile. Instead of uploading a legitimate document, they craft a PHP5 webshell containing system command execution functions and submit it with a .php5 extension. The server's inadequate validation accepts the file and stores it in a web-accessible directory. The attacker then directly requests the uploaded file via HTTP (e.g., https://target.example.com/uploads/malicious.php5), triggering server-side execution of the embedded PHP code and establishing remote command execution with web server privileges, enabling further system compromise, data exfiltration, or lateral movement.