External risk intelligence

Pachno XML External Entity Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-40042

Pachno is a wiki application that allows unauthenticated interaction via issue descriptions, comments, and wiki articles. Because these components are core features of public-facing or collaborative web-based knowledge management systems, the vulnerable interface is commonly exposed to the internet.

XML External Entity Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Pachno, a wiki application, related to how it processes text. An unauthenticated attacker could exploit this by injecting malicious code through common text inputs, potentially allowing them to access sensitive information on the system. The primary concern is to confirm if our organization uses this specific wiki software and if it is exposed in a way that could be targeted.

A flaw allows attackers to read files.
Vulnerability affects a widely exposed component.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by submitting specially crafted text containing malicious XML entities through user-facing features like issue descriptions or wiki articles. The application's unsafe handling of this XML input allows the attacker to trigger the vulnerability, potentially leading to the disclosure of sensitive information.

Unauthenticated access is required.
User-submitted text triggers the vulnerability.
Risk includes arbitrary file reading.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to read sensitive files from the server when supported by the advisory's context. This is possible through specially crafted wiki table syntax and inline tags within various user-generated content areas, exploiting insecure XML parsing.

Arbitrary file access.
Malicious XML injection.
Sensitive data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ownership of this vulnerability likely falls to the teams managing the Pachno wiki application, which could include application owners or platform teams responsible for its deployment and maintenance. The initial crucial step is to locate all instances of the affected software, determine their exposure and business criticality, and identify the accountable owner before planning remediation.

Identify affected Pachno instances.
Verify external reachability and criticality.
Plan remediation with the owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Pachno software?

Pachno is a web-based wiki application designed for knowledge management and collaborative documentation. It provides features such as issue tracking, comment threads, and wiki article editing, allowing teams to organize and share information within a centralized system.

What does XML external entity injection mean in CVE-2026-40042?

This vulnerability, classified as CWE-403, occurs when an application improperly processes XML data. Because the software uses an unsafe parsing method that resolves external entities without restrictions, an attacker can submit specially crafted XML code to trick the server into revealing the contents of arbitrary files from its own filesystem.

How can an attacker trigger this vulnerability?

An unauthenticated attacker triggers this flaw by injecting malicious XML entities into inputs processed by the system's TextParser, such as wiki table syntax or inline tags in comments and issue descriptions. The vulnerability is triggered during the parsing process; submitting standard text without these specific XML entity structures does not activate the malicious file-reading behavior.

Do I need to worry if my instance is internal?

Halo Surface Signal indicates that because Pachno's core features like issue descriptions and wiki articles are typically designed for collaborative or public-facing knowledge management, this software is often exposed to the internet. While internal instances face a lower risk of remote exploitation, they remain vulnerable to any actor with network access to the application.

How should I respond to this threat?

Start by identifying all Pachno deployments within your environment to determine which teams are responsible for their management. Verify the network accessibility and business criticality of each instance, then coordinate with the system owners to prioritize and plan the necessary remediation steps to secure the affected XML parsing components.

References

www.vulncheck.com/advisories/pachno-wiki-textparser-xml-external-entity…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.