CVE-2026-101008

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1

Description A command injection issue exists in the File Merge Handler component within the merge split file() function located in the /www/server/panel/class/files.py file. A remote attacker can exploit this by manipulating the split file path argument to execute arbitrary commands on the system.

Recommendations Update aaPanel BaoTa to a version later than 11.8.0. As a temporary mitigation, restrict access to the File Merge Handler component to prevent unauthorized remote exploitation.