CVE-2026-113505
CVE-2026-113505 · aaPanel Download Endpoint v2.py send_file path traversal
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVSS 5.3 · Moyenne · EPSS 0,5%
- Publication
- Mise à jour
Produits et versions concernés
aapanel
- Versions du logiciel
- 8.0: Concernée
- 8.1: Concernée
- 8.2: Concernée
- 8.3: Concernée
- 8.4: Concernée
- 8.5: Concernée
- 8.6: Concernée
- 8.7: Concernée
- 8.8: Concernée
- 8.9: Concernée
- 8.10: Concernée
- 8.11: Concernée
- 8.12: Concernée
- 8.13: Concernée
- 8.14: Concernée
- 8.15: Concernée
- 8.16: Concernée
- 8.17: Concernée
- 8.18: Concernée
- 8.19: Concernée
- 8.20: Concernée
- 8.21: Concernée
- 8.22: Concernée
- 8.23: Concernée
- 8.24: Concernée
- 8.25.0: Concernée
Aucun correctif publié