The vulnerability resides in the ExecShell function within the File Manager component of aaPanel. By manipulating the sfile/dfile/access/user arguments, an attacker can inject arbitrary operating system commands. This form of injection allows for execution of malicious commands, effectively granting the attacker full control over the underlying operating system. The weakness is classified under CWE‑77 and CWE‑78, indicating command injection and improper command execution paths.

aaPanel users running any version up to and including 8.25.0 are affected. The flaw is specific to the File Manager module that processes user inputs for file operations. Authentication is required to reach the vulnerable endpoint, so only privileged or credentialed users can exploit the flaw.

The CVSS base score of 9.4 indicates a critical severity. The EPSS score of 2% indicates a low but nonzero exploitation probability, although the publicly disclosed exploit demonstrates that attackers can readily target this vulnerability. The flaw is not listed in CISA's KEV catalog, but the existence of a public exploit means it is actively being leveraged. Attackers who can authenticate to the aaPanel interface can execute arbitrary commands on the host, compromising confidentiality, integrity, and availability.