Description
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 9.4 Critical
EPSS: 2.3% Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

The flaw resides in the merge_split_file function of aaPanel BaoTa’s File Merge Handler, where the split_file_path argument is not properly sanitized. A malformed value can be crafted to inject arbitrary shell commands through the underlying file system call. An attacker who can reach the vulnerable endpoint can thus execute commands with the privileges of the web application, leading to complete compromise of the affected server. This weakness is grounded in Command Injection (CWE‑77) and insufficient input validation (CWE‑74).

Affected Systems

All installations of aaPanel BaoTa up to and including version 11.8.0 are affected. The vulnerability is confined to the File Merge Handler (files.py) and does not extend to other components of aaPanel. Updated releases beyond 11.8.0 are presumed fixed, but verification is recommended.

Risk and Exploitability

The CVSS score of 9.4 classifies this issue as critical, and the EPSS score of 2% indicates a realistic exploitation window. Attackers can remotely access the vulnerable API or web interface, send a crafted split_file_path parameter, and gain arbitrary code execution. The vulnerability is not yet listed in the CISA KEV catalog, but its severity warrants immediate attention.

Generated by OpenCVE AI on September 28, 2026 at 15:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update aaPanel BaoTa to a version newer than 11.8.0 where the issue is patched.
  • If an upgrade is not feasible, limit access to the merge_split_file endpoint by firewall rules or authentication gates so that only trusted hosts can reach it.
  • In the absence of a patch, apply input validation to the split_file_path parameter, ensuring it contains only expected file path characters and rejecting any command separator sequences.

Generated by OpenCVE AI on September 28, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 07:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title aaPanel BaoTa File Merge files.py merge_split_file command injection
First Time appeared Aapanel
Aapanel baota
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:aapanel:baota:*:*:*:*:*:*:*:*
Vendors & Products Aapanel
Aapanel baota
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Aapanel Baota
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T12:51:57.748Z

Reserved: 2026-09-27T11:05:09.278Z

Link: CVE-2026-101008

cve-icon Vulnrichment

Updated: 2026-09-28T12:51:50.534Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T07:17:20.403

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-101008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T15:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')