CVE-2026-113505
Received
Received - Intake
Path Traversal in aaPanel Download Endpoint
Vulnerability report for CVE-2026-113505, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-20
Last updated on: 2026-10-20
Assigner: VulDB
Description
Description
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | aaPanel | 8.0 |
| n/a | aaPanel | 8.1 |
| n/a | aaPanel | 8.2 |
| n/a | aaPanel | 8.3 |
| n/a | aaPanel | 8.4 |
| n/a | aaPanel | 8.5 |
| n/a | aaPanel | 8.6 |
| n/a | aaPanel | 8.7 |
| n/a | aaPanel | 8.8 |
| n/a | aaPanel | 8.9 |
| n/a | aaPanel | 8.10 |
| n/a | aaPanel | 8.11 |
| n/a | aaPanel | 8.12 |
| n/a | aaPanel | 8.13 |
| n/a | aaPanel | 8.14 |
| n/a | aaPanel | 8.15 |
| n/a | aaPanel | 8.16 |
| n/a | aaPanel | 8.17 |
| n/a | aaPanel | 8.18 |
| n/a | aaPanel | 8.19 |
| n/a | aaPanel | 8.20 |
| n/a | aaPanel | 8.21 |
| n/a | aaPanel | 8.22 |
| n/a | aaPanel | 8.23 |
| n/a | aaPanel | 8.24 |
| n/a | aaPanel | 8.25.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
