CVE-2026-101008 aaPanel CVE debrief

Who should care

Defenders and administrators of aaPanel BaoTa installations should assess exposure and prioritize remediation. The exploit is public, and the vulnerability is high-severity, making it a priority for defensive actions.

Why it matters

CVE-2026-101008 is a high-severity vulnerability in aaPanel BaoTa that allows for remote command injection. Defenders should assess exposure, prioritize remediation, and verify affected versions and scope.

• Remote command injection is possible, allowing for potential unauthorized access
• The exploit has been made public, increasing the likelihood of exploitation
• The vulnerability is high-severity, with a CVSS score of 8.5
• Remediation is recommended as the vendor did not respond to disclosure

Technical summary

The vulnerability is in the merge_split_file function of /www/server/panel/class/files.py in aaPanel BaoTa up to 11.8.0. It allows remote command injection via manipulation of the split_file_path argument. The CVSS score is 8.5, and the severity is HIGH. The exploit has been made public, and although the vendor was contacted, no response was received. Defenders should assess exposure, prioritize remediation, and verify affected versions and scope. The vulnerability allows for remote command injection, which could lead to potential unauthorized access.

Defensive priority

Remediation is recommended as the exploit is public and the vulnerability is high-severity.

Recommended defensive actions

• Assess exposure to CVE-2026-101008 in the file merge handler of aaPanel BaoTa
• Prioritize remediation of the vulnerability as the exploit is public
• Verify affected versions and scope of the vulnerability
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. However, the vendor did not respond to disclosure, and some details like affected versions and scope require verification. The vulnerability is in aaPanel BaoTa up to 11.8.0, specifically in the merge_split_file function of /www/server/panel/class/files.py. The CVSS score is 8.5, and the severity is HIGH. The exploit has been made public, increasing the likelihood of exploitation. Defenders should assess exposure, prioritize remediation, and verify affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.