aaPanel 8.25.0 Has Remote Code Injection Flaw Requiring Login

A remote code execution vulnerability exists in aaPanel versions up to 8.25.0, affecting the File Manager component. The flaw allows attackers to inject operating system commands through specific arguments.

What happened

Security researchers identified a command injection flaw in the ExecShell function within the class/public/common.py file of aaPanel. This issue impacts all versions of the software up to and including 8.25.0. The vulnerability is tracked as CVE-2026-113506 and has been rated with a CVSS score of 8.6, which classifies it as high severity.

The weakness stems from improper handling of the sfile, dfile, access, and user arguments. According to the NVD record, these inputs are not sufficiently sanitized before being passed to the operating system. This allows an attacker to inject arbitrary OS commands. The associated CWE identifiers are CWE-77 and CWE-78, indicating improper neutralization of special elements in commands.

The exploit code for this vulnerability has been made public. This means the method for abusing the flaw is known to malicious actors. The vendor has confirmed the existence of the reported remote code execution and local file inclusion issues. However, the vendor explicitly states that these vulnerabilities require authentication to be exploited.

Why it matters

The high CVSS score of 8.6 reflects the potential impact of remote code execution on affected servers. While the requirement for authentication limits the attack surface compared to unauthenticated flaws, it still poses a significant risk. Attackers who obtain valid credentials can leverage this flaw to take full control of the underlying operating system.

The disclosure of the exploit to the public increases the likelihood of automated scanning and targeted attacks. Organizations using aaPanel for server management must assess their exposure. The combination of remote access and command injection capabilities means that compromised accounts can lead to complete system compromise.

What to watch

• Monitor authentication logs for unusual login attempts or privilege escalation.
• Check for unauthorized shell commands or new user accounts on affected servers.
• Look for signs of lateral movement from compromised aaPanel instances.
• Review file integrity monitoring alerts for changes in common.py.

Who needs to act first

Teams usually prioritize systems exposed to the internet or accessible via remote management portals. Check whether your aaPanel instances are reachable from untrusted networks. If a patch is not yet available, restrict access to the management interface using strict IP allow-lists. Ensure that all administrative accounts use strong, unique credentials and multi-factor authentication. Back up configuration files before making any changes to the environment.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: aaPanel

• Audit all aaPanel installations to identify versions up to 8.25.0.
• Enforce multi-factor authentication for all administrative accounts.
• Restrict network access to the management interface using firewalls.
• Monitor system logs for unexpected command execution or file changes.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of aaPanel are affected by this vulnerability?

All versions of aaPanel up to and including 8.25.0 are affected by CVE-2026-113506.

Is authentication required to exploit this flaw?

Yes, the vendor confirms that the reported RCE and LFI vulnerabilities require authentication.

What is the CVSS score for this vulnerability?

The vulnerability has a CVSS score of 8.6, which is rated as high severity.