CVE-2026-113506: OS Command Injection in aaPanel

This vulnerability exists in the ExecShell function of the file class/public/common.py within the File Manager component of aaPanel versions up to 8.25.0. By manipulating the sfile, dfile, access, or user arguments, an authenticated attacker can perform OS command injection remotely. The vendor confirms that exploitation requires authentication, limiting the attack surface. The vulnerability is publicly disclosed with a CVSS 4.0 score of 9.4, indicating critical severity. No patch or remediation details are provided in the input data.

Successful exploitation allows an authenticated remote attacker to execute arbitrary OS commands on the affected system, potentially leading to full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, the requirement for authentication reduces the risk to some extent by limiting exploitation to authorized users or compromised credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since exploitation requires authentication, ensure that access controls and authentication mechanisms are robust. Monitor for updates from the vendor regarding official fixes or mitigations.