A vulnerability classified as critical was found in Pachno 1.0.6. The impacted element is the function
simplexml_load_string of the component XML Parser. The manipulation results in exposure of file descriptor to unintended control sphere (‘file descriptor leak’).
This vulnerability is known as CVE-2026-40042. It is possible to launch the attack remotely. No exploit is available.
