CVE-2026-113505: aaPanel Download Endpoint v2.py send_file path traversal
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated because the vendor states that the reported LFI and RCE vulnerabilities require authentication. The vulnerable download endpoint is remotely reachable, so any authenticated user able to access it may be relevant to triage.
What versions are known to be affected?
aaPanel versions up to and including 8.25.0 are identified as impacted. The provided data does not identify a fixed version.
What is the impact of manipulating the filename parameter?
Manipulating the filename argument passed to send_file can cause path traversal in BTPanel/routes/v2.py. This may allow access to files outside the intended download path; the listed confidentiality impact is low, with no integrity or availability impact stated.
How urgent is remediation?
The issue is rated medium with a CVSS score of 4.3, but an exploit has been published and may be used. Prioritize systems where lower-privileged authenticated users can reach the download endpoint.