# CVE-2026-113505: aaPanel path traversal in download endpoint

Source: https://junglewise.ai/threats/cve-2026-113505-a-flaw-has-been-found-in-aapanel-up-to-8-25-0-impacted-is-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113505 · Severity: medium · CVSS 4.3 · Published 2026-10-20

aaPanel is a web-based hosting control panel that runs with root privileges on Linux servers. A vulnerability in its file download functionality allows authenticated users to read arbitrary files from the server, including sensitive system files like /etc/shadow and TLS encryption keys. An attacker with a valid session can exfiltrate confidential data such as password hashes, database credentials, and private cryptographic material.

Technologies: [aaPanel](https://junglewise.ai/threats/technologies/aapanel). Vendors: [aaPanel](https://junglewise.ai/threats/vendors/aapanel).

## Quick answers

**Is CVE-2026-113505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113505 being exploited in the wild.

**How severe is CVE-2026-113505?** Medium severity, with a CVSS score of 4.3, published 20 October 2026.

**Which products and versions are affected?** aaPanel up to 8.25.0.

**Is there a fix for CVE-2026-113505?** No fixed version is recorded yet. Restrict downloads to an explicit allowlist root directory (such as backups or site directories) and validate that resolved file paths remain within that allowed root using os.path.realpath() checks. Apply identical path validation to both download endpoints and remove inconsistent filename splitting logic.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}, {"kind": "other", "at": "2026-09-23", "note": "Vendor notified"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113505 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113505?** Check whether you run aaPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict downloads to an explicit allowlist root directory (such as backups or site directories) and validate that resolved file paths remain within that allowed root using os.path.realpath() checks. Apply identical path validation to both download endpoints and remove inconsistent filename splitting logic.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}, {"kind": "other", "at": "2026-09-23", "note": "Vendor notified"}]

## Technical details

Two download endpoints (/v2/download and /download) in aaPanel fail to properly validate file paths, allowing path traversal attacks. The /v2/download endpoint performs no path filtering beyond existence checks; the /download endpoint's attempted fix using ".." filtering can be bypassed via absolute paths and a pipe-trick payload. Authentication via valid session, API key, or temporary login token is required; the attack executes remotely over HTTPS and allows reading of files accessible to the root-running daemon.

## Affected products

- aaPanel aaPanel up to 8.25.0

## References

- [https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-lfi](https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-lfi)
- [https://vuldb.com/cve/CVE-2026-113505](https://vuldb.com/cve/CVE-2026-113505)

## Related threats

- [aaPanel IP allowlist and brute-force protection bypass via X-Real-Ip spoofing](https://junglewise.ai/threats/cve-2026-113507-a-vulnerability-was-found-in-aapanel-up-to-8-25-0-the-impacted)
- [aaPanel OS command injection in File Manager](https://junglewise.ai/threats/cve-2026-113506-a-vulnerability-has-been-found-in-aapanel-up-to-8-25-0-the)