CVE-2026-113505
MediumCVSS 4.3Summary
In aaPanel up to 8.25.0, the send_file function in BTPanel/routes/v2.py of the Download Endpoint component allows manipulation of the filename argument leading to path traversal. The attack can be executed remotely, the exploit has been published and may be used, and the vendor confirms the reported RCE and LFI vulnerabilities require authentication.
Risk Assessment
An attacker may exploit path traversal to access files outside the intended directory, potentially leading to data disclosure or further exploitation.
Recommendation
Update aaPanel to a version later than 8.25.0 if available and restrict access to the download endpoint while enforcing strong authentication.
Other vulnerabilities in aaPanel
Original NVD description (English source)
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS