Aapanel

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorAapanel (2c58d342-62d5-5d4c-b34a-1e5a15c9d356)
ProductAapanel (8bd148a4-28ef-5457-8130-510bca750027)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:docker/aapanel/aapanel purl2cpe 2026-06-01 10:11:34.852724
pkg:github/aapanel/aapanel purl2cpe 2026-06-01 10:11:34.852727

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-113505 vulnerable 2026-11-03 10:16:27.711575 aaPanel Download Endpoint v2.py send_file path traversal
MEDIUM (4.3)
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Published: 2026-10-20T16:15:14.151Z
Updated: 2026-10-21T15:53:45.957Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-113506 vulnerable 2026-11-03 10:16:27.415122 aaPanel File Manager common.py ExecShell os command injection
CRITICAL (9.9)
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Published: 2026-10-20T17:15:12.655Z
Updated: 2026-10-20T19:05:49.453Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-113507 vulnerable 2026-11-03 10:16:27.053646 aaPanel common.py GetClientIp access control
MEDIUM (5.3)
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Published: 2026-10-20T17:30:15.196Z
Updated: 2026-10-23T01:57:09.895Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-42922 vulnerable 2026-06-08 06:45:47.111584 Details available
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
Published: 2025-05-21T00:00:00.000Z
Updated: 2025-05-21T17:51:00.960Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-37840 vulnerable 2026-06-08 05:32:54.783221 Details available
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).
Published: 2021-08-02T13:53:57.000Z
Updated: 2024-08-04T01:30:08.582Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-14950 vulnerable 2026-06-08 05:19:25.023645 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-14421 vulnerable 2026-06-08 05:19:23.337137 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.