CVE-2026-113505

Deferred Deferred - Pending Action

Path Traversal in aaPanel Download Endpoint

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: VulDB

Description

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113505

EUVD

EUVD-2026-105174

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	aaPanel	8.0
n/a	aaPanel	8.1
n/a	aaPanel	8.2
n/a	aaPanel	8.3
n/a	aaPanel	8.4
n/a	aaPanel	8.5
n/a	aaPanel	8.6
n/a	aaPanel	8.7
n/a	aaPanel	8.8
n/a	aaPanel	8.9
n/a	aaPanel	8.10
n/a	aaPanel	8.11
n/a	aaPanel	8.12
n/a	aaPanel	8.13
n/a	aaPanel	8.14
n/a	aaPanel	8.15
n/a	aaPanel	8.16
n/a	aaPanel	8.17
n/a	aaPanel	8.18
n/a	aaPanel	8.19
n/a	aaPanel	8.20
n/a	aaPanel	8.21
n/a	aaPanel	8.22
n/a	aaPanel	8.23
n/a	aaPanel	8.24
n/a	aaPanel	8.25.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in aaPanel versions up to 8.25.0. It exists in the send_file function of BTPanel/routes/v2.py, specifically in the Download Endpoint. By manipulating the filename argument, an attacker can perform path traversal to read arbitrary files on the server. The vendor notes that exploitation requires authentication.

Detection Guidance

Check for unauthorized access to sensitive files via the /v2/download or /download endpoints. Use tools like curl to test if arbitrary file reads are possible. Example: curl -H 'Cookie: session=YOUR_SESSION' http://TARGET/v2/download?filename=/etc/passwd. Monitor logs for unusual file access patterns or requests to these endpoints.

Impact Analysis

An attacker with access can read sensitive files such as /etc/shadow, TLS keys, databases, or other users' web content. This is possible because the panel daemon runs as root, allowing full system file access. Exploits can use session cookies, API keys, or temporary login tokens to bypass restrictions.

Compliance Impact

This vulnerability allows remote attackers with authentication to read arbitrary local files, including sensitive data like /etc/shadow, TLS keys, and databases. Such unauthorized access could lead to exposure of personal data, violating GDPR and HIPAA compliance requirements for data protection and confidentiality.

Mitigation Strategies

Upgrade aaPanel to the latest version if available. Restrict access to the /v2/download and /download endpoints. Implement strict path validation and allowlisting for file downloads. Remove or disable unused endpoints. Monitor for exploitation attempts and unauthorized file access.

Hi! I’m here to help you understand CVE-2026-113505. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...