CVE-2026-113506

CriticalCVSS 9.9

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Summary

A vulnerability was found in aaPanel up to 8.25.0 in the ExecShell function of class/public/common.py in the File Manager component. Manipulation of the sfile/dfile/access/user arguments leads to OS command injection, exploitable remotely. The exploit has been publicly disclosed, and the vendor confirms the reported RCE and LFI issues require authentication.

Risk Assessment

An authenticated attacker can execute arbitrary commands on the server, potentially leading to full host compromise and data loss. Public exploit availability increases the likelihood of rapid exploitation.

Recommendation

Upgrade aaPanel beyond 8.25.0 as soon as a fix is available, and restrict access to the panel and privileged accounts. Monitor logs for unusual File Manager invocations.

Other vulnerabilities in aaPanel

CVE-2026-113505Medium
In aaPanel up to 8.25.0, the send_file function in BTPanel/routes/v2.py of the Download Endpoint component allows manipulation of the filename argument leading to path traversal. The attack can be executed remotely, the exploit has been published and may be used, and the vendor confirms the reported RCE and LFI vulnerabilities require authentication.

Original NVD description (English source)

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

Vulnerability data from NVD (NIST) · CISA KEV · EPSS