Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by VulDB

CVE-2026-113506aaPanel File Manager common.py ExecShell os command injection

Critical 9.9

In plain English

A critical-severity OS command injection in aaPanel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

Affected products (as reported)

VendorProductVersions
n/a aaPanel 8.08.18.28.38.48.58.68.7

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

References