CVE-2026-113507
MediumCVSS 5.3Summary
In aaPanel up to 8.25.0, the GetClientIp function in class/public/common.py manipulates the X-Real-Ip argument, leading to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used. The vendor confirms that the reported X-Real-Ip IP-bypass vulnerability has already been fixed.
Risk Assessment
An attacker may bypass IP-based access controls, potentially gaining unauthorized access to protected panel functions. The public exploit increases the risk.
Recommendation
Update aaPanel to a version containing the fix (above 8.25.0). Verify that the X-Real-Ip header is not used for authentication without additional validation.
Other vulnerabilities in aaPanel
See all- CVE-2026-113505Medium
In aaPanel up to 8.25.0, the send_file function in BTPanel/routes/v2.py of the Download Endpoint component allows manipulation of the filename argument leading to path traversal. The attack can be executed remotely, the exploit has been published and may be used, and the vendor confirms the reported RCE and LFI vulnerabilities require authentication.
- CVE-2026-113506Critical
A vulnerability was found in aaPanel up to 8.25.0 in the ExecShell function of class/public/common.py in the File Manager component. Manipulation of the sfile/dfile/access/user arguments leads to OS command injection, exploitable remotely. The exploit has been publicly disclosed, and the vendor confirms the reported RCE and LFI issues require authentication.
Original NVD description (English source)
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Vulnerability data from NVD (NIST) · CISA KEV · EPSS