aaPanel EUVD-2026-105212

Exploitation requires an authenticated aaPanel session (vendor-confirmed; CVSS PR:L) with access to the File Manager component. The attacker must reach the ExecShell code path in class/public/common.py and inject shell metacharacters into one of the specific arguments sfile, dfile, access, or user. Affected versions are aaPanel up to and including 8.25.0. The primary limiting factor is the authentication requirement - the panel is not exploitable pre-auth - so realistic risk is highest where panels are internet-exposed, use weak/shared/reused credentials, or grant panel accounts to semi-trusted users; it is lower where the panel is restricted to trusted administrators on isolated networks.

This is a genuine priority within its deployment base, though not an indiscriminate internet-wide threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the vendor statement agree that exploitation is network-based, low-complexity, requires no user interaction, but DOES require authentication (PR:L) - an important limiting factor the vendor explicitly confirms ('The reported RCE and LFI vulnerabilities require authentication.'). This is an authenticated OS command injection (CWE-78) in the File Manager's ExecShell function, so the realistic abuse case is a low-privileged or compromised panel account escalating to full OS command execution, or an attacker who has obtained credentials via phishing/reuse. Publicly available exploit code exists (GitHub PoC), which raises operational risk, but this is NOT confirmed active exploitation - it is not in CISA KEV. The CVSS 4.0 string carries E:P (Proof-of-Concept), consistent with the PoC-exists signal and NOT with in-the-wild use. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The single reporting/intelligence source is VulDB, so corroboration is limited to one vendor plus the disclosed PoC. Net: real and actionable for anyone running aaPanel ≤8.25.0 with multiple or internet-exposed panel accounts, but the authentication requirement meaningfully reduces mass-exploitation risk compared with an unauthenticated RCE.

An attacker who holds valid (even low-privileged) aaPanel credentials - or who has phished/reused a panel login - submits a crafted request to the File Manager, injecting shell metacharacters into the sfile, dfile, access, or user argument processed by ExecShell in class/public/common.py. Because the panel typically runs with high privileges, the injected OS command executes on the host, yielding full server compromise. A public proof-of-concept (GitHub: JdExploit/aapanel-cve-2026) exists, lowering the skill barrier, though exploitation still requires an authenticated session.