aaPanel CVE-2026-113507

Exploitation requires that the aaPanel deployment relies on IP-based access control or logging that uses the client IP derived from GetClientIp, and that the application trusts the attacker-supplied X-Real-Ip request header without validating it against a trusted reverse proxy. The concrete prerequisite is any configuration where source-IP allowlisting is used as a security boundary; the limiting factor is that instances which do not use IP-based restrictions (or which strip/override X-Real-Ip at a trusted proxy) gain little from the bypass. No authentication is required per the CVSS vector (PR:N), and exploitation affects aaPanel versions up to 8.25.0.

This is a moderate-severity access-control bypass (CWE-284) in aaPanel's GetClientIp function, where the X-Real-Ip HTTP header is trusted as the client's source IP. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation, but the impact metrics are deliberately narrow (VC:L, VI:N, VA:N) - only a limited confidentiality effect, no integrity or availability impact - which is consistent with the CVSS 6.9 (MEDIUM) score rather than a critical rating. The E:P (Proof-of-Concept) exploit maturity aligns with the input signal that a public POC exists on GitHub. This CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of widespread automated exploitation; the signals point to a real but bounded issue - useful for bypassing IP-based allowlists rather than direct compromise. The vendor (aaPanel) has confirmed the issue is fixed, which raises confidence that the vulnerability is genuine, but no specific patched version is given in the input. Net: a legitimate, publicly-exploitable weakness that chiefly matters where IP allowlisting is the security control, not a high-urgency RCE-class priority. Note the only reporting source is VulDB; no independent NVD or vendor advisory text is provided beyond the vendor's quoted confirmation.

An attacker who knows that an aaPanel instance restricts access (e.g., to a management endpoint) by source IP sends a request with a forged X-Real-Ip header set to a whitelisted/trusted address, causing GetClientIp to treat the request as originating from an allowed IP and bypassing the access control. A public proof-of-concept exists on GitHub (JdExploit/aapanel-cve-2026), and because CVSS indicates network vector with low complexity and no authentication, the request can be sent directly without special tooling.