CVE-2026-113505: Path Traversal in aaPanel

A path traversal vulnerability exists in the send_file function of the Download Endpoint component in aaPanel versions up to 8.25.0. By manipulating the filename argument, an authenticated remote attacker can traverse directories to access files outside the intended directory scope. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, and low privileges required. The vendor notes that exploitation requires authentication. Exploit code has been published, increasing the risk of exploitation by authenticated users.

An authenticated remote attacker can exploit this vulnerability to perform path traversal, potentially accessing sensitive files on the server that should be restricted. This could lead to information disclosure or facilitate further attacks such as local file inclusion or remote code execution. However, exploitation requires authentication, limiting the attack surface to users with valid credentials.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires authentication, restricting access to trusted users and monitoring authenticated sessions may reduce risk until a fix is applied.