The vulnerability resides in the InputSql function of the database backup handler in aaPanel BaoTa. Manipulation of the Password argument allows an attacker to inject arbitrary OS commands, resulting in remote command execution with the privileges of the web server process, as the flaw is an OS command injection (CWE‑77, CWE‑78).

All users of aaPanel for its BaoTa control panel are affected if their installation is version 11.8.0 or earlier. The backup feature, accessed through class/database.py, is the component that processes the vulnerable Password parameter.

The CVSS score of 9.3 marks this flaw as critical, indicating high impact and ease of exploitation. An EPSS score of 2% shows a non‑negligible probability of exploitation; the flaw is public, the vendor has not responded, and the attack can be triggered remotely by crafting an HTTP request that supplies a malicious Password value. Successful exploitation would give an attacker persistent control over the host.