CVE-2026-40042
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-40042 is a critical-severity File Descriptor Leak (CWE-403) vulnerability in Zeroscience (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Pachno version 1.0.6 is affected by CVE-2026-40042, an XML external entity (XXE) injection vulnerability in the TextParser helper. The flaw arises from unsafe XML parsing using simplexml_load_string() without LIBXML_NONET restrictions, enabling the injection of malicious XML entities. This issue, classified under CWE-403, carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-13.
Unauthenticated attackers can exploit the vulnerability remotely with low complexity and no user interaction required. By injecting malicious XML entities through wiki table syntax and inline tags in issue descriptions, comments, or wiki articles, attackers trigger entity resolution to read arbitrary files on the server. The high confidentiality, integrity, and availability impacts allow potential full compromise of the affected Pachno instance.
Advisories from VulnCheck (https://www.vulncheck.com/advisories/pachno-wiki-textparser-xml-external-entity-injection) and Zero Science (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5984.php) provide further details on the vulnerability for security practitioners to review mitigation strategies and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22049
Vulnerability Data
Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in…
more
issue descriptions, comments, and wiki articles to trigger entity resolution via simplexml_load_string() without LIBXML_NONET restrictions.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Maintains separate execution domains so file descriptors cannot be unintentionally inherited by child processes.
Prevents unintended information transfer via shared file descriptors between parent and child processes.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code reviews and static analysis that catch file-descriptor leaks before child-process invocation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover descriptor leaks but does not prevent them by itself.
Secure SDLC practices include code reviews and static analysis that can detect leaked descriptors.
Secure coding rules require closing inherited file descriptors before spawning child processes.
Information access restriction policies may limit which processes can use descriptors, but do not address the leak itself.