CVE-2026-29858
Local File Inclusion in aaPanel v7.57.0 Exposes Sensitive Data
Publication date: 2026-03-18
Last updated on: 2026-03-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aapanel | aapanel | 7.57.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-29858 is a Local File Inclusion (LFI) vulnerability in aaPanel version 7.57.0 and earlier. It occurs because the application does not properly validate file paths in the "/download?filename=" parameter. This flaw allows attackers with temporary login access, granted via a "tmp_token" link, to include and read arbitrary local files on the server.'}, {'type': 'paragraph', 'content': 'Since aaPanel runs with root privileges, exploiting this vulnerability can expose highly sensitive system files such as /etc/passwd and /etc/shadow, which contain user credentials and password hashes. This can lead to a full system compromise.'}, {'type': 'paragraph', 'content': 'The vulnerability can also be combined with a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-29859) to automate file downloads via injected scripts.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized disclosure of sensitive system files and user credentials. Because aaPanel runs with root privileges, an attacker exploiting this flaw can gain access to critical files like /etc/passwd and /etc/shadow.
Such exposure significantly increases the risk of full system compromise, allowing attackers to escalate privileges and potentially take complete control over the affected server.
Additionally, the vulnerability can be exploited in combination with other vulnerabilities to automate attacks, increasing the threat level.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the vulnerable endpoint with crafted URLs that try to include local files. For example, sending HTTP requests to the aaPanel server targeting the "/download?filename=" parameter with path traversal payloads such as "../../../../etc/passwd" or "../../../../etc/shadow" can reveal if the server is vulnerable.'}, {'type': 'list_item', 'content': 'Use curl or wget commands to test the endpoint, for example:'}, {'type': 'list_item', 'content': 'curl -k "https://IP_ADDRESS:PORT/download?filename=../../../../etc/passwd"'}, {'type': 'list_item', 'content': 'curl -k "https://IP_ADDRESS:PORT/download?filename=../../../../etc/shadow"'}, {'type': 'paragraph', 'content': 'Successful retrieval of sensitive files like /etc/passwd or /etc/shadow indicates the presence of the vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the vulnerable endpoint and disabling or limiting the use of temporary login tokens (tmp_token) that allow temporary authentication.'}, {'type': 'paragraph', 'content': 'Additionally, applying any available patches or updates from aaPanel that address this path validation issue is critical.'}, {'type': 'paragraph', 'content': 'If patching is not immediately possible, consider implementing network-level controls such as firewall rules to restrict access to the aaPanel management interface only to trusted IP addresses.'}, {'type': 'paragraph', 'content': 'Monitoring logs for suspicious access patterns to the "/download?filename=" parameter can also help detect exploitation attempts.'}] [1]