CVE-2026-40042 is an XML external entity injection vulnerability in pancho's Pachno 1.0.6. The issue stems from unsafe XML parsing in the TextParser helper, where simplexml_load_string() is called without the LIBXML_NONET flag, allowing network access during entity resolution. Attackers can inject malicious XML entities through wiki table syntax and inline tags in various user-editable fields such as issue descriptions, comments, and wiki articles. This enables unauthenticated attackers to read arbitrary files on the server, leading to exposure of sensitive information. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected system, potentially exposing sensitive information. This can lead to significant confidentiality breaches. The vulnerability does not require user interaction or privileges, increasing its risk. There are no known exploits in the wild currently, but the critical severity and ease of exploitation make this a high-risk issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting XML parsing features that use simplexml_load_string() without LIBXML_NONET or apply custom input validation to block malicious XML entities. Monitor vendor channels for updates and apply patches promptly once released.