aaPanel BaoTa File Merge Command Injection Vulnerability

A vulnerability was found in aaPanel BaoTa up to 11.8.0. The affected component is the File Merge Handler in the file /www/server/panel/class/files.py.

The function merge_split_file allows manipulation of the argument split_file_path, resulting in command injection. The attack can be carried out remotely, and the exploit has been made public.

• Affected versions: up to 11.8.0
• Attack vector: remote
• Impact: command injection

The vendor was contacted early about this disclosure but did not respond.