CVE-2026-113507: aaPanel common.py GetClientIp access control
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be performed remotely and does not require privileges or user interaction. Exploitation involves manipulating the X-Real-Ip request argument to bypass IP-based access controls.
Which installations are affected?
aaPanel versions up to 8.25.0 are identified as affected. The vulnerable code is the GetClientIp function in class/public/common.py.
How urgent is remediation?
A public exploit is available, and the issue can expose information through an access-control bypass. The vendor states that the X-Real-Ip bypass has already been fixed, so administrators should use the vendor-fixed release.