CVE-2026-113506: aaPanel File Manager common.py ExecShell os command injection
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires authentication. An attacker must have credentials for aaPanel and be able to reach the File Manager remotely.
Which deployments are affected?
aaPanel File Manager installations running aaPanel up to version 8.25.0 are affected. The issue is in the File Manager implementation in class/public/common.py.
What level of access can successful exploitation provide?
The vulnerable ExecShell function can be manipulated through the sfile, dfile, access, or user arguments to inject operating-system commands. The reported impact includes high confidentiality, integrity, and availability impact, with scope changed.
How urgent is remediation?
This is rated critical with a 9.9 severity score, and a public exploit has been disclosed. Treat authenticated aaPanel access as a significant exposure until affected systems are remediated.