CVE-2026-113506 in aaPanel
Summary
by MITRE • 10/20/2026
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
A critical remote code execution vulnerability exists within aaPanel versions up to 8.25.0, specifically affecting the File Manager component. This flaw is located in the ExecShell function found in the class/public/common.py file. The root cause of this issue stems from improper neutralization of special elements used in an operating system command, which allows for OS command injection. An attacker can manipulate specific arguments related to file operations, particularly those involving sfile/dfile/access/user parameters, to inject arbitrary commands into the underlying shell environment. This type of vulnerability is formally classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command and aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it enables the execution of system-level commands through a web application interface.
The operational impact of this vulnerability is severe due to its remote nature. Although the vendor has confirmed that authentication is required to exploit these vulnerabilities, meaning they are not exploitable by unauthenticated anonymous users over the internet without valid credentials, the risk remains significant for any instance where user accounts exist and have access to the File Manager feature. Once authenticated, an attacker can leverage this command injection flaw to execute arbitrary commands with the privileges of the web server process. This typically results in full system compromise, allowing the attacker to read sensitive configuration files, install backdoors, pivot to other internal systems, or exfiltrate data. The disclosure that exploit code is publicly available further elevates the threat landscape, as automated scanning tools and malicious actors can readily utilize these exploits against vulnerable instances without needing custom development efforts.
Mitigation strategies must focus on immediate remediation through software updates and strict access control measures. The primary defense is to upgrade aaPanel to a version newer than 8.25.0 where the vendor has presumably patched this input validation flaw. In cases where upgrading is not immediately feasible, administrators should enforce multi-factor authentication for all panel accounts to reduce the likelihood of credential compromise via phishing or brute force attacks. Additionally, restricting access to the File Manager component by IP whitelist can limit exposure to trusted networks only. It is also advisable to run the web server under a restricted user account with minimal permissions rather than root privileges, thereby limiting the potential damage if an injection attempt succeeds. Regular security audits and monitoring of system logs for unusual command executions are recommended to detect any attempted exploitation activities early in the kill chain.