CVE-2026-113506
A vulnerability has been found in aaPanel up to 8.25.0
- Risk score
- 76/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 2.1%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in aaPanel up to 8.25.0 allows for remote os command injection via the File Manager's ExecShell function, enabling an attacker to potentially gain high-level access and manipulate the system.
- Affected
- {'products': ['aaPanel'], 'packages': [], 'versions': ['up to 8.25.0']}
- Fix
- Check the linked advisory for a fix; no specific instructions are provided in this record.
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 9.9 critical
References
Original description
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Last activity 20 Oct 2026. Patch Forecast updates every hour.