CVE-2026-113506
CVE-2026-113506 · aaPanel File Manager common.py ExecShell os command injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVSS 9.4 · Critical · EPSS 2.1%
- Published
- Updated
Affected products and versions
aapanel
- Versions
- 8.0: Affected
- 8.1: Affected
- 8.2: Affected
- 8.3: Affected
- 8.4: Affected
- 8.5: Affected
- 8.6: Affected
- 8.7: Affected
- 8.8: Affected
- 8.9: Affected
- 8.10: Affected
- 8.11: Affected
- 8.12: Affected
- 8.13: Affected
- 8.14: Affected
- 8.15: Affected
- 8.16: Affected
- 8.17: Affected
- 8.18: Affected
- 8.19: Affected
- 8.20: Affected
- 8.21: Affected
- 8.22: Affected
- 8.23: Affected
- 8.24: Affected
- 8.25.0: Affected
No fix published