CVE-2026-113507 | aaPanel up to 8.25.0 class/public/common.py GetClientIp X-Real-Ip access control

October 20, 2026 Yanac

A vulnerability was found in aaPanel up to 8.25.0 and classified as problematic. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls.

This vulnerability was named CVE-2026-113507. The attack may be performed from remote. In addition, an exploit is available.

The vendor confirms: “The reported X-Real-Ip IP-bypass vulnerability has already been fixed”.VulDB Recent EntriesRead More