aaPanel File Manager OS Command Injection Vulnerability

A vulnerability has been found in aaPanel up to 8.25.0. The affected component is the File Manager, specifically the ExecShell function in class/public/common.py.

Manipulation of the sfile/dfile/access/user arguments leads to OS command injection. The attack can be carried out remotely, and the exploit has been publicly disclosed and may be used.

• Affected versions: aaPanel up to 8.25.0
• Requires authentication: the vendor confirms the reported RCE and LFI vulnerabilities require authentication