CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-40044
Severity
CRITICAL
CVSS
9.8
EPSS
0.48%
Original NVD Description
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.