aaPanel BaoTa CVE-2026-101011

Requires an authenticated session with HIGH privileges on the aaPanel/BaoTa control panel (per CVSS PR:H) and network reachability to the panel interface; the specific trigger is supplying attacker-controlled input in the get argument processed by the get_domain_status function of the Domain Handler (domainMod.py). No user interaction is needed (UI:N). Limiting factors: exploitation is gated on already holding privileged panel credentials, so it is not an unauthenticated/default-config attack; impact is bounded (low C/I/A) rather than full DB compromise or RCE. No fix is available since the vendor did not respond, so exposure persists on affected installs up to 11.8.0.

Signals are mixed and point to a modest-priority issue despite the flaw touching a widely-deployed product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a remotely-reachable, low-complexity attack but requires HIGH privileges (PR:H) - i.e. an already-authenticated, high-privilege panel operator - which sharply narrows the realistic attacker set. Technical impact is uniformly LOW (VC:L/VI:L/VA:L), consistent with a SQL injection whose reach is bounded rather than a full database takeover or code execution; this is why the vendor score is only 5.1. EPSS is not provided and this CVE is NOT in CISA KEV, so there is no evidence of active exploitation; however, POC/exploit code IS publicly available (E:P in the vector; public gist), which raises the practical likelihood of opportunistic use by anyone who already holds panel credentials. No SSVC decision data was supplied. Net: this is a genuine but lower-tier issue - the PR:H requirement and LOW impact keep it well below the root-RCE aaPanel siblings (CVE-2026-101007/101008/101009). CONFLICT/GAP to verify: the description says only 'remotely' and never states the privilege prerequisite, so the PR:H rating rests entirely on the vendor CVSS vector and should be confirmed against the actual code path (whether get_domain_status is reachable by lower-privilege users would materially raise risk).

An authenticated, high-privilege aaPanel operator (or an attacker who has obtained such credentials) sends a crafted request to the Domain Handler, manipulating the get argument consumed by get_domain_status in domainMod.py to inject SQL. Public exploit code exists (gist), lowering the effort to reproduce. Because attack complexity is low and the vector is network-based, exploitation is straightforward once the required panel access is held, but the impact is limited to low-level confidentiality/integrity/availability effects on the backing database.