CVE-2026-40040 describes an unrestricted file upload vulnerability in Pachno 1.0.6. Authenticated users can bypass ineffective extension filtering controls on the /uploadfile endpoint to upload arbitrary file types, including executable PHP scripts. These files can be placed in web-accessible directories and executed, allowing attackers to achieve remote code execution on the affected server. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows authenticated attackers to upload and execute arbitrary code on the server hosting Pachno 1.0.6. This can lead to full compromise of the affected system, including data theft, service disruption, or further network penetration. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent unauthorized file uploads and monitor for suspicious activity related to file uploads. Avoid exposing the /uploadfile endpoint to untrusted users if possible.