CVE-2026-40044 — Pachno 1.0.6 FileCache Deserialization Remote Code Execution
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files.…
Published: 2026-04-13 · CVSS: 9.3 · CVSS 4.0
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7