CVE-2026-101008: aaPanel BaoTa Command Injection Vulnerability

CVE-2026-101008 Overview

CVE-2026-101008 is a command injection vulnerability in aaPanel BaoTa versions up to 11.8.0. The flaw resides in the merge_split_file function within /www/server/panel/class/files.py, part of the File Merge Handler component. Attackers can manipulate the split_file_path argument to inject arbitrary operating system commands. The vulnerability is exploitable over the network and a public proof-of-concept exists. The vendor was contacted prior to disclosure but did not respond, leaving affected deployments without an official patch at publication time. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can execute arbitrary commands on the host operating system by abusing the split_file_path parameter, leading to full compromise of the BaoTa panel server.

Affected Products

aaPanel BaoTa versions up to and including 11.8.0
Component: File Merge Handler (/www/server/panel/class/files.py)
Function: merge_split_file

Discovery Timeline

2026-09-28 - CVE-2026-101008 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101008

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input passed to the merge_split_file function in /www/server/panel/class/files.py. This handler is responsible for recombining split file segments uploaded through the BaoTa web interface. The split_file_path argument is incorporated into a shell command without adequate sanitization or quoting.

An attacker who can reach the panel API and submit a crafted request causes the injected shell metacharacters to be interpreted by the underlying operating system. Because the aaPanel service typically runs with elevated privileges to manage web stacks, databases, and system services, successful injection results in high-impact code execution against the host.

The EPSS score of 2.336% places this issue in the 82.9th percentile, indicating meaningful real-world exploitation interest relative to the broader CVE population.

Root Cause

The root cause is insufficient input validation of the split_file_path parameter before it is concatenated into a system command string. The function does not escape shell metacharacters such as ;, &&, |, or backticks, allowing attacker-controlled content to break out of the intended argument context and execute additional commands.

Attack Vector

The attack requires network access to the aaPanel BaoTa web interface and authenticated privileges to invoke the file merge endpoint. The attacker submits a request to the merge handler with a crafted split_file_path value containing shell operators and secondary commands. Upon processing, the panel executes the injected payload under the service account. Full technical details and a proof-of-concept are available in the GitHub Gist PoC and the VulDB entry for CVE-2026-101008.

Detection Methods for CVE-2026-101008

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running /www/server/panel/BT-Panel or related panel scripts.
HTTP requests to BaoTa file management endpoints containing shell metacharacters (;, |, &&, $(), backticks) in the split_file_path parameter.
New or modified files in /www/server/panel/ or world-writable directories outside normal panel operations.
Outbound network connections initiated by the panel process to unknown hosts shortly after file merge activity.

Detection Strategies

Inspect panel access logs for POST requests to file merge endpoints with suspicious characters in parameters.
Deploy process-lineage monitoring to flag shell interpreters (sh, bash) launched as children of the BaoTa Python process.
Correlate web request timestamps with host-level process creation events to identify injection patterns.

Monitoring Recommendations

Enable verbose logging on the BaoTa panel and forward logs to a centralized SIEM for retention and correlation.
Alert on anomalous command execution originating from web application service accounts.
Monitor file integrity for /www/server/panel/class/files.py and related panel code to detect tampering.

How to Mitigate CVE-2026-101008

Immediate Actions Required

Restrict network access to the aaPanel BaoTa management interface using firewall rules or VPN-only access.
Rotate all administrator credentials for the panel and audit account activity for unauthorized logins.
Disable or block the file merge functionality at a reverse proxy where feasible until a vendor fix is released.
Audit the host for signs of post-exploitation activity, including new users, scheduled tasks, and persistence mechanisms.

Patch Information

At publication, the vendor has not released an official patch and did not respond to disclosure attempts. Monitor the VulDB vulnerability record and official aaPanel channels for updates. Operators should treat all exposed BaoTa instances up to version 11.8.0 as vulnerable.

Workarounds

Place the BaoTa panel behind a web application firewall (WAF) with rules that reject requests containing shell metacharacters in file path parameters.
Enforce IP allow-listing on the panel port to limit exposure to trusted administrator networks only.
Run the panel under a dedicated low-privilege account where operationally viable to limit blast radius of command injection.
Apply mandatory access controls (SELinux or AppArmor) to constrain the panel process from executing unexpected binaries.

bash

# Example iptables rule to restrict panel access to an admin subnet
iptables -A INPUT -p tcp --dport 8888 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP