aaPanel vulnerabilities
CVEs whose affected-version data names the aaPanel package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-113506Critical· 9.9PoCaaPanel File Manager common.py ExecShell os command injection
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os…
CVE-2026-113507Medium· 5.3aaPanel common.py GetClientIp access control
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be per…
CVE-2026-113505Medium· 4.3aaPanel Download Endpoint v2.py send_file path traversal
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The atta…