{"id":"CVE-2026-113506","published":"2026-10-20T18:17:18.633","lastModified":"2026-10-20T19:27:34.430","description":"A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The reported RCE and LFI vulnerabilities require authentication.\"","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-rce","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-113506","tags":[]},{"url":"https://vuldb.com/submit/996819","tags":[]},{"url":"https://vuldb.com/vuln/422748","tags":[]},{"url":"https://vuldb.com/vuln/422748/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-rce","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in aaPanel's File Manager component that allows authenticated attackers to execute arbitrary OS commands remotely. This critical flaw can lead to full system compromise and data theft.","exploitability":"Exploitation requires authentication but is straightforward once credentials are obtained, as the vulnerability affects a core file manager function with predictable parameter manipulation.","blast_radius":"The impact could be extensive across all systems running vulnerable aaPanel versions, potentially affecting multiple servers and their hosted applications if attackers leverage compromised accounts.","remediation":"Upgrade to aaPanel version 8.25.1 or later to address this command injection vulnerability.","detection":"Monitor for unusual process execution patterns in system logs when authenticated users access the File Manager component, particularly shell command invocations with suspicious parameters.","tags":["rce","file-manager","command-injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:19:36.101Z"}}