The vulnerability exists in aaPanel version 7.57.0 due to insufficient path validation. This flaw allows an attacker to execute a local file inclusion (LFI), which can expose sensitive information stored on the server. The weakness maps to CWE‑98, indicating a failure to restrict file inclusion to trusted paths. Files outside the intended directory could be read or executed, compromising data confidentiality and potentially enabling further exploitation.

Only aaPanel 7.57.0 is affected. No other versions or vendors are listed as impacted.

The CVSS score of 7.5 classifies the issue as high severity, while an EPSS score of less than 1% suggests low current exploitation probability. This vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector involves invoking the web interface of aaPanel; the lack of path validation is likely exploitable remotely by anyone who can send crafted requests to the affected endpoint. Attackers could read arbitrary local files, leading to confidentiality loss or execution of arbitrary code if files are executed.