aaPanel CVE-2026-113505

Requires a valid authenticated aaPanel session with at least a low-privileged account (vendor explicitly states the LFI/RCE class requires authentication; CVSS PR:L), after which the attacker manipulates the 'filename' argument of the send_file download endpoint in BTPanel/routes/v2.py to escape the intended directory. No user interaction is needed and the endpoint is reachable over the network, but exploitation is LIMITED by: (1) the need for prior authentication to the panel, and (2) the operating-system file permissions of the aaPanel web process, which bound which files can be read. Affects aaPanel versions up to and including 8.25.0.

This is a moderate, authentication-gated path traversal (CWE-22) in aaPanel's download endpoint, and the signals are largely consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) and the vendor's explicit statement - 'The reported RCE and LFI vulnerabilities require authentication' - agree that an attacker needs a valid low-privileged account, so this is NOT a pre-auth internet-wide crisis. Exploitation maturity is 'proof-of-concept' (E:P) and a public exploit is published on GitHub, which raises practical risk, but there is NO CISA KEV entry and NO EPSS score in the provided data, so there is no evidence of widespread automated exploitation at this time. The main caveat is impact scope: the input scores confidentiality as only VC:L, yet an arbitrary-file-read path traversal in a server control panel can typically expose sensitive files (panel config, credentials, keys) accessible to the web process, which would justify a higher confidentiality rating - this discrepancy should be verified against the actual file-access constraints of the send_file handler. Net: a real but authenticated, confidentiality-focused issue worth prioritizing for exposed/multi-tenant aaPanel instances, not a drop-everything unauthenticated RCE.

An attacker who already holds a low-privileged, authenticated aaPanel account sends a request to the download endpoint (send_file in BTPanel/routes/v2.py) with a crafted 'filename' value containing directory-traversal sequences. Because the public exploit code exists (GitHub PoC), the attacker reuses it to read files outside the intended download directory - for example panel configuration or credential files - enabling further escalation such as the vendor-noted authenticated LFI/RCE paths.