CVE-2026-40040
Published: 13 April 2026
Summary
CVE-2026-40040 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-40040 is an unrestricted file upload vulnerability in Pachno version 1.0.6, stemming from ineffective extension filtering at the /uploadfile endpoint. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), enables authenticated users to upload arbitrary file types, including executable .php5 scripts, to web-accessible directories. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to network accessibility, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability.
Authenticated users with low privileges can exploit this vulnerability remotely by bypassing the extension checks and uploading malicious files, such as .php5 scripts, to locations executable by the web server. Successful exploitation leads to remote code execution (RCE) on the affected server, allowing attackers to run arbitrary commands, potentially resulting in full server takeover.
Advisories published by VulnCheck (https://www.vulncheck.com/advisories/pachno-unrestricted-file-upload-remote-code-execution) and Zero Science Lab (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5982.php) provide detailed technical analysis of the vulnerability, including proof-of-concept exploitation steps. Practitioners should consult these resources for specific mitigation guidance, such as upgrading to a patched version of Pachno if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22045
Vulnerability details
Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 scripts to web-accessible directories and execute them to…
more
achieve remote code execution on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unrestricted file upload of executable scripts (e.g., .php5) to web-accessible directories in a public-facing web application, enabling exploitation of public-facing applications (T1190) and deployment/execution of web shells (T1100) for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces comprehensive validation of information inputs, directly addressing the ineffective extension filtering that allows arbitrary executable file uploads like .php5 scripts.
Requires timely identification, reporting, and remediation of software flaws such as this unrestricted file upload vulnerability to prevent RCE exploitation.
Deploys malicious code protection mechanisms to scan and block or detect dangerous uploaded files, such as executable scripts, before they can be executed.