CVE-2026-40040CWE-434

Pachno 1.0.6 Unrestricted File Upload Remote Code Execution

High · published April 13, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 scripts to web-accessible directories and execute them to achieve remote code execution on the server.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00835 · 57.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-04-13T18:10Z
EPSS history
Timeline
  • 13 APR 18:10Z
    Pachno 1.0.6 Unrestricted File Upload Remote Code Execution
    cvelistv5