---
id: CVE-2026-113506
title: aaPanel File Manager common.py ExecShell os command injection
summary: >-
  A vulnerability has been found in aaPanel up to 8.25.0. The affected element
  is the function ExecShell of the file class/public/common.py of the component
  File Manager. The manipulation of the argument sfile/dfile/access/user leads
  to os…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
product: aaPanel
affected:
  - aaPanel 8.0
  - aaPanel 8.1
  - aaPanel 8.2
  - aaPanel 8.3
  - aaPanel 8.4
  - aaPanel 8.5
  - aaPanel 8.6
  - aaPanel 8.7
  - aaPanel 8.8
  - aaPanel 8.9
  - aaPanel 8.10
  - aaPanel 8.11
  - aaPanel 8.12
  - aaPanel 8.13
  - aaPanel 8.14
  - aaPanel 8.15
  - aaPanel 8.16
  - aaPanel 8.17
  - aaPanel 8.18
  - aaPanel 8.19
  - aaPanel 8.20
  - aaPanel 8.21
  - aaPanel 8.22
  - aaPanel 8.23
  - aaPanel 8.24
  - aaPanel 8.25.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T19:05:42.449095Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T19:05:49.453Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113506'
references:
  - url: 'https://vuldb.com/vuln/422748'
    label: VDB-422748 | aaPanel File Manager common.py ExecShell os command injection
  - url: 'https://vuldb.com/vuln/422748/cti'
    label: 'VDB-422748 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113506'
    label: CVE-2026-113506 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/996819'
    label: >-
      Submit #996819 | aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit
      4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) OS Command Injection
      (CWE-78)
  - url: 'https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-rce'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-20T18:14:37.221Z'
---

## Overview

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

## Affected

- `aaPanel 8.0`
- `aaPanel 8.1`
- `aaPanel 8.2`
- `aaPanel 8.3`
- `aaPanel 8.4`
- `aaPanel 8.5`
- `aaPanel 8.6`
- `aaPanel 8.7`
- `aaPanel 8.8`
- `aaPanel 8.9`
- `aaPanel 8.10`
- `aaPanel 8.11`
- `aaPanel 8.12`
- `aaPanel 8.13`
- `aaPanel 8.14`
- `aaPanel 8.15`
- `aaPanel 8.16`
- `aaPanel 8.17`
- `aaPanel 8.18`
- `aaPanel 8.19`
- `aaPanel 8.20`
- `aaPanel 8.21`
- `aaPanel 8.22`
- `aaPanel 8.23`
- `aaPanel 8.24`
- `aaPanel 8.25.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.