aaPanel: Remote OS Command Injection via File Manager (CVE-2026-113506)

aaPanel, a popular web hosting control panel, contains a critical OS command injection vulnerability (CVE-2026-113506) affecting versions up to and including 8.25.0. The flaw resides within the ExecShell function located in class/public/common.py within the File Manager component. By manipulating specific input arguments - specifically sfile, dfile, access, or user - an authenticated attacker can bypass intended input sanitization and trigger the execution of arbitrary system commands on the underlying host operating system. The vulnerability is exploitable remotely, and public exploit code is available, heightening the risk of system compromise.

Impact

Successful exploitation of this vulnerability results in full remote code execution (RCE) with the privileges of the web server process. In a hosting environment, this could allow an attacker to pivot between hosted sites, exfiltrate sensitive configuration files, modify database content, or deploy persistence mechanisms. The impact is assessed as critical due to the ease of exploitation and the potential for complete system take-over.

Recommendation

• Update aaPanel to a version released after 8.25.0 that addresses this vulnerability.
• Implement restrictive access controls for the web administration interface to minimize the number of authenticated users capable of reaching the vulnerable File Manager component.
• Monitor server logs for suspicious system-level command execution (e.g., whoami, id, wget, curl) initiated by the web server service account.
• Apply network-level restrictions to ensure the aaPanel administrative interface is not exposed to the public internet.