CVE-2026-113505 in aaPanel
Summary
by MITRE • 10/20/2026
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
A critical security vulnerability has been identified within aaPanel, specifically affecting versions up to 8.25.0, involving the Download Endpoint component located in the file BTPanel/routes/v2.py. The flaw resides within the send_file function, which is responsible for serving files to users through the web interface. This issue manifests as a path traversal vulnerability, allowing an attacker to manipulate the filename argument passed to this function. By carefully crafting input that includes directory traversal sequences such as dot-dot-slash characters, it is possible to break out of the intended file-serving directory and access arbitrary files on the underlying operating system.
The technical nature of this flaw aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. In typical web application architectures, functions designed for serving static content or downloads must strictly validate input parameters to ensure they do not reference paths outside the designated root directory. The failure in aaPanel’s implementation allows an authenticated user to bypass these restrictions. Although the vendor has confirmed that both this Local File Inclusion (LFI) and related Remote Code Execution vulnerabilities require authentication, the existence of a published exploit indicates that attackers with valid credentials can leverage this flaw for significant malicious purposes.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and system compromise. An attacker who gains access to an aaPanel account can use path traversal to read sensitive configuration files, source code containing hardcoded secrets or API keys, database connection strings, and other critical system resources stored on the server. This capability effectively neutralizes the security boundary provided by the application layer, granting the attacker deep visibility into the server's internal structure and data stores. Furthermore, if combined with other vulnerabilities that allow for file upload or execution of arbitrary commands, this path traversal can serve as a pivot point to achieve full remote code execution on the host system.
From an offensive security perspective, this vulnerability maps directly to MITRE ATT&CK technique T1083, which covers File and Directory Discovery. Attackers utilize such techniques during the reconnaissance phase to map out the target environment before proceeding to more destructive actions like data staging or exfiltration. The fact that the exploit has been published lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts against publicly accessible aaPanel instances. Even though authentication is required, many administrators may use weak passwords or have accounts exposed through other means such as credential stuffing attacks on common default ports associated with panel software.
Mitigation strategies must focus primarily on immediate patching and access control hardening. Administrators should upgrade to a version of aaPanel that has addressed this vulnerability, ensuring they consult the vendor’s official security advisories for specific fixed versions. In cases where upgrading is not immediately feasible, implementing strict input validation at the web server or reverse proxy level can help block requests containing path traversal sequences before they reach the application logic. Additionally, enforcing strong authentication policies and multi-factor authentication reduces the risk of unauthorized access to accounts that could be exploited via this flaw. Network segmentation should also be considered to limit lateral movement in the event that an attacker gains initial foothold through compromised credentials. Regular audits of file permissions and directory structures can further reduce the impact if such a vulnerability is successfully exploited, ensuring that even with path traversal, sensitive files remain inaccessible due to operating system-level restrictions.