aaPanel vulnerabilities
We track 7 vulnerabilities in aaPanel products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest aaPanel vulnerabilities
- 7.4 High severity
BillionMail: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead t
- 9.9 Critical severity
aaPanel: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The
- 8.4 High severity
BaoTa: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can l
- 9.1 Critical severity
BaoTa: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command in
- 8.4 High severity
BaoTa: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack
- 7.5 High severity
Aapanel: Uncontrolled Resource Consumption
An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS) via a crafted input.
- 8.8 High severity
aapanel WP Toolkit: Missing Authorization
The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and