Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.
| Vendor | Product | Versions |
|---|---|---|
| pachno | pachno | 1.0.6 |
Updated severity to CRITICAL and added CVE-2026-40044 as a new tag.
Initial creation
