CVE-2026-113506
9.9CriticalPublished 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-77, CWE-78
Impact
Authenticated attackers can execute arbitrary OS commands remotely with the privileges of the aaPanel service. They require network access to the panel and valid credentials.
Root cause
The ExecShell function in class/public/common.py fails to sanitize the sfile, dfile, access, and user parameters in the File Manager component, allowing command injection.
Affected systems
aaPanel up to 8.25.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
No fixed version is listed; restrict network access to the aaPanel management interface via firewall or VPN, and audit panel user accounts to prevent unauthorized access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."