Live › vulnerability › CVE-2026-113506
Go to dashboardaaPanel 8.0 through 8.25.0 passes sfile, dfile, access or user arguments from the File Manager into ExecShell (class/public/common.py) without neutralising them, so a logged-in panel user can run OS commands, reportedly as root. A PoC is public (JdExploit). The vendor says the bug needs authentication. No fixed release is documented.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| aaPanel | vendor | >= 8.0, <= 8.25.0 | – |
8.25.0 is in the reported rangeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
This page as .md · .json · in your agent: get_signal("CVE-2026-113506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.