CVE-2026-101010

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1

Description A remote SQL injection is possible through the manipulation of the log type argument within the getData() function located in the /www/server/panel/class/data.py file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

Recommendations Update aaPanel BaoTa to a version newer than 11.8.0. As a temporary workaround, restrict access to the getData() function in the /www/server/panel/class/data.py file to minimize the risk of exploitation.