| Title | aaPanel aaPanel Linux Panel v8.22.0 (GitHub commit 4af59b2386e118fc0e4b2ae838dacac992d16b1c, 2026-08-27) OS Command Injection (CWE-78) |
|---|
| Description | An authenticated OS command injection (remote code execution) vulnerability
exists in aaPanel v8.22.0 (commit 4af59b2) in the file-manager /files module.
User-controlled parameters are embedded unescaped into single-quoted shell
strings which are then executed by ExecShell() =
subprocess.Popen(cmdstring, shell=True) (class/public/common.py:966).
Vectors:
A) Zip compression - class_v2/panel_task_v2.py:438 (also tar.gz :444,
rar :450, 7z :459). sfiles/dfile are wrapped as " '<value>'" without
escaping the single quote, so a quote break-out executes arbitrary commands.
PoC (authenticated):
POST /files?action=Zip&z_type=zip&path=/tmp&sfile=ok.txt
&dfile=/tmp/x';touch /tmp/pwned;echo '
B) UnZip - class_v2/panel_task_v2.py:580 (zip), :602 (war); rar (:593) escapes
only & and " but NOT the single quote. The password is injected directly:
"unzip -X -P '" + password + "' -o '...".
PoC (authenticated):
POST /files?action=UnZip&sfile=/tmp/a.zip&dfile=/tmp
&password=';touch /tmp/pwned;echo '
C) SetFileAccess - class_v2/files_v2.py:3308-3310. access/user concatenated
unquoted into chmod/chown:
chmod -R <access> '<filename>'; chown -R <user>:<user> '<filename>'
PoC (authenticated):
POST /v2/files?action=SetFileAccess&filename=/tmp/target
&access=777;touch /tmp/pwned;echo #
POST /v2/files?action=SetFileAccess&filename=/tmp/target
&user=root;touch /tmp/pwned;echo #
All three were validated by executing the exact constructed command strings in
a POSIX shell: each payload successfully created a marker file (e.g.
/tmp/pwned), confirming command execution. The panel daemon runs as root, so
this is remote code execution as root on the host server.
CVSS 3.1 (est.): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 High) auth RCE.
Vendor was contacted ([email protected]) on 2026-09-23. No CVE assigned yet,
no submission to another CNA. |
|---|
| User | jdexploit (UID 100293) |
|---|
| Submission | 09/23/2026 22:00 (1 month ago) |
|---|
| Moderation | 10/20/2026 12:53 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422748 [aaPanel up to 8.25.0 File Manager class/public/common.py ExecShell sfile/dfile/access/user os command injection] |
|---|
| Points | 20 |
|---|