CVE-2026-101009
HighCVSS 8.4Summary
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to OS command injection. The attack may be performed from remote, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely execute arbitrary OS commands, potentially leading to full server compromise. The vulnerability is publicly known and may be exploited.
Recommendation
Due to the vendor's lack of response, it is recommended to discontinue use of this product or implement custom validation of the Password argument. Contact the vendor for further information.
Other vulnerabilities in aaPanel BaoTa
See all- CVE-2026-101011Medium
A SQL injection vulnerability was discovered in aaPanel BaoTa up to 11.8.0, affecting the get_domain_status function in /www/server/panel/mod/project/domain/domainMod.py (Domain Handler component). Manipulation of the get argument allows remote SQL injection. The exploit has been publicly released and the vendor did not respond to the disclosure.
- CVE-2026-101010Medium
A SQL injection vulnerability was identified in aaPanel BaoTa up to 11.8.0, affecting the getData function in /www/server/panel/class/data.py. Manipulation of the log_type argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available; the vendor did not respond to the disclosure.
- CVE-2026-101007High
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Manipulation of the argument Password leads to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public.
- CVE-2026-101008Critical
A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS