Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported RCE and LFI vulnerabilities require authentication."
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 CVE-2026-113506 (CVSS 9.9 Critical) - PoC Available OS command injection in aaPanel File Manager (ExecShell) allows remote attackers to execute arbitrary shell commands. ⚡ Action: Update aaPanel to > v8.25.0. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-113506/ https://t.co/vmWKim7Tj0