Live › vulnerability › CVE-2026-113505
Go to dashboardThe send_file function in the Download Endpoint of aaPanel up to 8.25.0 does not properly sanitize the filename argument, enabling path traversal. An authenticated attacker can use it to read files outside the intended download directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running aaPanel 8.25.0 or earlier that expose its web panel. The vendor states the related issues require authentication, so exposure depends on who holds panel credentials. unknown whether a patched release exists in the sources.
No product ranges from the sources yet.
8.25.0 (the affected range is up to and including this version)BTPanel/routes/v2.py in the install for the send_file handler and whether filename is sanitizedUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
This page as .md · .json · in your agent: get_signal("CVE-2026-113505")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.