| Título | aaPanel BaoTa < 11.8.0 Command Injection |
|---|
| Descrição | The `merge_split_file` action merges split files by executing `cat {split_file_path}* > {merged_file_path}` with `shell=True`. The `split_file_path` is not obtained directly from HTTP, but is read from the contents of a JSON file planted by an attacker and then concatenated into the shell command without any escaping. An authenticated admin user can first inject malicious JSON via `UploadFile`, then call `merge_split_file` to execute arbitrary commands as **root**. The API also returns a message stating “Split files merged successfully.”
The vendor maintainer has acknowledged the issue and has already implemented a fix; however, the patched version 11.8.1 has not yet been released.
Affected Versions and Components:
- Product: Baota Linux Panel (https://github.com/aaPanel/BaoTa)
- Process: `/www/server/panel/BT-Panel`
- File: `/www/server/panel/class/files.py`
- Route: `POST /files?action=merge_split_file`
- Prerequisite: An admin user can write a JSON file to disk via the File Manager or the `UploadFile` function.
Vulnerability Code:
https://github.com/aaPanel/BaoTa/blob/main/class/files.py#L3163-L3196
# files.py:3163 — json_file_path comes from HTTP
json_file_path = get.get(‘json_file_path’, ‘’)
# files.py:3170 — split_file_path is read from the JSON file content
split_file_path = json_content.get(“split_file_path”, “”)
# files.py:3187 — No escaping; direct `format` call
merge_cmd = “cat {}* > {}”.format(split_file_path, merged_file_path)
# files.py:3189 — `shell=True`!
result = subprocess.run(merge_cmd, shell=True, ...)
`split_file_path` is fully controllable by an attacker (via injected JSON), allowing unfiltered access to `shell=True`. A `;` character can be used to append commands.
Prerequisites:
1. Valid admin credentials for the dashboard
2. An `x-http-token` bound to the session
3. The admin must be able to write a JSON file
PoC, Proof, and original email correspondence with the vendor's maintainer, please see the reference URL: https://gist.github.com/zuesdevil/56b73463ffe3390f670a5c031764a134 |
|---|
| Fonte | ⚠️ https://gist.github.com/zuesdevil/56b73463ffe3390f670a5c031764a134 |
|---|
| Utilizador | zuesdevil (UID 100502) |
|---|
| Submissão | 11/08/2026 10h51 (há 2 meses) |
|---|
| Moderação | 27/09/2026 13h05 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 410878 [aaPanel BaoTa até 11.8.0 File Merge files.py merge_split_file split_file_path Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|