aaPanel BaoTa CVE-2026-101010

Requires a valid high-privilege authenticated session to the aaPanel BaoTa web panel (CVSS PR:H) - this is not remote-unauthenticated. Once authenticated, the attacker reaches the getData function in /www/server/panel/class/data.py and supplies a malicious log_type argument that is concatenated into a SQL query. No user interaction and no non-default configuration is indicated (UI:N, AC:L). The primary limiting factor is the high-privilege authentication barrier; the exploit is meaningfully useful only where an attacker has already compromised or been granted panel admin access.

This is a real but bounded issue whose signals argue against high urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L, base 5.1) makes the single most important limiting factor explicit: PR:H, meaning the attacker must already hold high-privilege authenticated access to the BaoTa panel before reaching the vulnerable getData function. CWE-89 SQL injection combined with public POC code (VulDB E:P) means a working exploit exists, but POC availability is a distinct signal from active exploitation - there is no CISA KEV listing and no EPSS score provided, so exploitation is not confirmed in the wild. My independent read is that the vendor's VC:L/VI:L/VA:L understates a classic SQL injection, which typically permits full read of the panel database (credentials, config) - I assess C:H - but the practical value is diminished because an attacker with PR:H panel access can already do far more damaging things (the sibling aaPanel CVEs are command-injection-to-root); this SQLi is a lateral/secondary primitive rather than a break-in. Net: publicly available exploit code exists but requires high-privilege authentication, so this is a medium-severity, low-to-medium-priority issue rather than a high-real-risk emergency, despite the product's large footprint.

An attacker who has already obtained high-privilege credentials to an aaPanel BaoTa (<=11.8.0) web panel sends a crafted value in the log_type argument to the getData handler in class/data.py, injecting SQL that the backend executes against the panel database. Public exploit code is available on a GitHub gist (zuesdevil), lowering the effort to reproduce. The attacker uses the injection to read or manipulate stored panel data such as site configuration and credential material.