CVE-2026-101008
CriticalCVSS 9.1Summary
A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.
Risk Assessment
A remote attacker could execute arbitrary system commands on the server, potentially leading to full compromise of the server and hosted applications. The public availability of the exploit increases the risk.
Recommendation
Due to the vendor's lack of response and the public exploit, it is recommended to restrict access to the aaPanel interface to trusted networks only, deploy WAF rules, and consider an alternative server management solution.
Other vulnerabilities in aaPanel BaoTa
See all- CVE-2026-101011Medium
A SQL injection vulnerability was discovered in aaPanel BaoTa up to 11.8.0, affecting the get_domain_status function in /www/server/panel/mod/project/domain/domainMod.py (Domain Handler component). Manipulation of the get argument allows remote SQL injection. The exploit has been publicly released and the vendor did not respond to the disclosure.
- CVE-2026-101010Medium
A SQL injection vulnerability was identified in aaPanel BaoTa up to 11.8.0, affecting the getData function in /www/server/panel/class/data.py. Manipulation of the log_type argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available; the vendor did not respond to the disclosure.
- CVE-2026-101009High
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to OS command injection. The attack may be performed from remote, and the exploit has been publicly disclosed.
- CVE-2026-101007High
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Manipulation of the argument Password leads to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public.
Original NVD description (English source)
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS