PT-2026-99784 · Unknown · Aapanel Baota
CVSS v3.1
8.4
High
| Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
aaPanel BaoTa versions prior to 11.8.1
Description
An OS command injection flaw exists in the Unzip Handler component. A remote attacker can exploit this by manipulating the
Password argument within the panelTask.bt task. unzip() function located in the /www/server/panel/class/panelTask.py file.Recommendations
Update to a version later than 11.8.0.
As a temporary mitigation, restrict access to the Unzip Handler functionality.
Exploit
Fix
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Aapanel Baota