CVE-2026-113505 | aaPanel up to 8.25.0 Download Endpoint BTPanel/routes/v2.py send_file filename path traversal

SecurityVulns
Yanac

A vulnerability, which was classified as problematic, was found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal.

This vulnerability is handled as CVE-2026-113505. The attack can be executed remotely. Additionally, an exploit exists.

The vendor confirms: “The reported RCE and LFI vulnerabilities require authentication.”VulDB Recent EntriesRead More