---
id: CVE-2026-113505
title: aaPanel Download Endpoint v2.py send_file path traversal
summary: >-
  A flaw has been found in aaPanel up to 8.25.0. Impacted is the function
  send_file of the file BTPanel/routes/v2.py of the component Download Endpoint.
  Executing a manipulation of the argument filename can lead to path traversal.
  The atta…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-22
product: aaPanel
affected:
  - aaPanel 8.0
  - aaPanel 8.1
  - aaPanel 8.2
  - aaPanel 8.3
  - aaPanel 8.4
  - aaPanel 8.5
  - aaPanel 8.6
  - aaPanel 8.7
  - aaPanel 8.8
  - aaPanel 8.9
  - aaPanel 8.10
  - aaPanel 8.11
  - aaPanel 8.12
  - aaPanel 8.13
  - aaPanel 8.14
  - aaPanel 8.15
  - aaPanel 8.16
  - aaPanel 8.17
  - aaPanel 8.18
  - aaPanel 8.19
  - aaPanel 8.20
  - aaPanel 8.21
  - aaPanel 8.22
  - aaPanel 8.23
  - aaPanel 8.24
  - aaPanel 8.25.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:15:14.151Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113505'
references:
  - url: 'https://vuldb.com/vuln/422747'
    label: VDB-422747 | aaPanel Download Endpoint v2.py send_file path traversal
  - url: 'https://vuldb.com/vuln/422747/cti'
    label: 'VDB-422747 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113505'
    label: CVE-2026-113505 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/996818'
    label: >-
      Submit #996818 | aaPanel aaPanel Linux Panel v8.22.0 (commit
      4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Path Traversal /
      Local File Inclusion (CWE-22)
  - url: 'https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-lfi'
tags:
  - cve.org
ingestedAt: '2026-10-20T17:12:53.605Z'
---

## Overview

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

## Affected

- `aaPanel 8.0`
- `aaPanel 8.1`
- `aaPanel 8.2`
- `aaPanel 8.3`
- `aaPanel 8.4`
- `aaPanel 8.5`
- `aaPanel 8.6`
- `aaPanel 8.7`
- `aaPanel 8.8`
- `aaPanel 8.9`
- `aaPanel 8.10`
- `aaPanel 8.11`
- `aaPanel 8.12`
- `aaPanel 8.13`
- `aaPanel 8.14`
- `aaPanel 8.15`
- `aaPanel 8.16`
- `aaPanel 8.17`
- `aaPanel 8.18`
- `aaPanel 8.19`
- `aaPanel 8.20`
- `aaPanel 8.21`
- `aaPanel 8.22`
- `aaPanel 8.23`
- `aaPanel 8.24`
- `aaPanel 8.25.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.