| Title | aaPanel aaPanel Linux Panel v8.22.0 (commit 4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) Path Traversal / Local File Inclusion (CWE-22) |
|---|
| Description | A path traversal / local file inclusion vulnerability exists in the file
download endpoints of aaPanel v8.22.0 (commit 4af59b2, released 2026-08-27).
Two independent vectors are present in the current code:
1) /v2/download (BTPanel/routes/v2.py:1015-1047): the handler takes the
filename from the request, and the ONLY check is os.path.exists() before
calling send_file(). There is no ".." filter, no os.path.abspath() confinement,
no extension or directory allowlist. Any file readable by the panel process
(which runs as root) is served to the caller.
PoC (authenticated session or valid tmp_token):
GET /v2/download?filename=/etc/shadow
2) /download (BTPanel/__init__.py:2072-2098): the CVE-2026-29858 fix (v7.57.0)
is incomplete. The patch only rejects path segments equal to ".."; absolute
paths without ".." pass every check and are served by send_file(). In addition,
the "|" handling now uses split('|')[1], so "filename=x|/etc/shadow" resolves
to "/etc/shadow", bypassing the intent of the fix.
PoC:
GET /download?filename=/etc/shadow
GET /download?filename=x|/etc/shadow
Impact: arbitrary read of root-readable files (/etc/shadow, TLS private keys,
database files, other users' web content) using a panel session, an API key,
or the tmp_token temporary-login primitive (the same primitive that enabled
CVE-2026-29858). The panel daemon runs as root, so this leads to full system
compromise / credential disclosure.
CVSS 3.1 (est.): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5); with
tmp_token primitive: 7.5 High.
Vendor was contacted ([email protected]) on 2026-09-23. No CVE assigned yet,
no submission to another CNA. |
|---|
| Source | ⚠️ https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-lfi |
|---|
| User | jdexploit (UID 100293) |
|---|
| Submission | 09/23/2026 21:58 (1 month ago) |
|---|
| Moderation | 10/20/2026 12:53 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422747 [aaPanel up to 8.25.0 Download Endpoint BTPanel/routes/v2.py send_file filename path traversal] |
|---|
| Points | 20 |
|---|