5.3
Medium
CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0
Description
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| aaPanel | 8.25.0 | No fix stated |
| aaPanel | 8.24 | No fix stated |
| aaPanel | 8.23 | No fix stated |
| aaPanel | 8.22 | No fix stated |
| aaPanel | 8.21 | No fix stated |
| aaPanel | 8.20 | No fix stated |
| aaPanel | 8.19 | No fix stated |
| aaPanel | 8.18 | No fix stated |
| aaPanel | 8.17 | No fix stated |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| aaPanel | 8.16 | No fix stated |
| aaPanel | 8.15 | No fix stated |
| aaPanel | 8.14 | No fix stated |
| aaPanel | 8.13 | No fix stated |
| aaPanel | 8.12 | No fix stated |
| aaPanel | 8.11 | No fix stated |
| aaPanel | 8.10 | No fix stated |
| aaPanel | 8.9 | No fix stated |
| aaPanel | 8.8 | No fix stated |
| aaPanel | 8.7 | No fix stated |
| aaPanel | 8.6 | No fix stated |
| aaPanel | 8.5 | No fix stated |
| aaPanel | 8.4 | No fix stated |
| aaPanel | 8.3 | No fix stated |
| aaPanel | 8.2 | No fix stated |
| aaPanel | 8.1 | No fix stated |
| aaPanel | 8.0 | No fix stated |