---
id: CVE-2026-113507
title: aaPanel common.py GetClientIp access control
summary: >-
  A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the
  function GetClientIp of the file class/public/common.py. The manipulation of
  the argument X-Real-Ip results in improper access controls. The attack may be
  per…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-284
  - CWE-266
product: aaPanel
affected:
  - aaPanel 8.0
  - aaPanel 8.1
  - aaPanel 8.2
  - aaPanel 8.3
  - aaPanel 8.4
  - aaPanel 8.5
  - aaPanel 8.6
  - aaPanel 8.7
  - aaPanel 8.8
  - aaPanel 8.9
  - aaPanel 8.10
  - aaPanel 8.11
  - aaPanel 8.12
  - aaPanel 8.13
  - aaPanel 8.14
  - aaPanel 8.15
  - aaPanel 8.16
  - aaPanel 8.17
  - aaPanel 8.18
  - aaPanel 8.19
  - aaPanel 8.20
  - aaPanel 8.21
  - aaPanel 8.22
  - aaPanel 8.23
  - aaPanel 8.24
  - aaPanel 8.25.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T17:30:15.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113507'
references:
  - url: 'https://vuldb.com/vuln/422749'
    label: VDB-422749 | aaPanel common.py GetClientIp access control
  - url: 'https://vuldb.com/vuln/422749/cti'
    label: 'VDB-422749 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113507'
    label: CVE-2026-113507 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/996821'
    label: >-
      Submit #996821 | aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit
      4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Improper Validation
      of Input Trusted in Security Decision
  - url: 'https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip'
tags:
  - cve.org
ingestedAt: '2026-10-20T18:14:37.219Z'
---

## Overview

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".

## Affected

- `aaPanel 8.0`
- `aaPanel 8.1`
- `aaPanel 8.2`
- `aaPanel 8.3`
- `aaPanel 8.4`
- `aaPanel 8.5`
- `aaPanel 8.6`
- `aaPanel 8.7`
- `aaPanel 8.8`
- `aaPanel 8.9`
- `aaPanel 8.10`
- `aaPanel 8.11`
- `aaPanel 8.12`
- `aaPanel 8.13`
- `aaPanel 8.14`
- `aaPanel 8.15`
- `aaPanel 8.16`
- `aaPanel 8.17`
- `aaPanel 8.18`
- `aaPanel 8.19`
- `aaPanel 8.20`
- `aaPanel 8.21`
- `aaPanel 8.22`
- `aaPanel 8.23`
- `aaPanel 8.24`
- `aaPanel 8.25.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.