Aapanel

10 CVEs across 3 Aapanel products. Browse Aapanel vulnerabilities, severities, and proof-of-concept exploits.

Aapanel products with known CVEs

ProductCVEs
Aapanel8
Aapanel Wp Toolkit1
Baota1
Aapanel CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-29859Critical9.82026-03-18An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2026-29858High7.52026-03-18A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure.
CVE-2026-29856High7.52026-03-18An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS)…
CVE-2025-12914Medium4.72025-11-08A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the com…
CVE-2025-6813High8.82025-07-18The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versi…
CVE-2024-42922Medium6.52025-05-21AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
CVE-2022-26252Medium6.52022-03-27aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).
CVE-2021-37840High8.82021-08-02aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must…
CVE-2020-14950High8.82020-06-21aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin reques…
CVE-2020-14421High7.22020-06-18aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen.