CVE-2026-101009: aaPanel BaoTa OS Command Injection RCE

CVE-2026-101009 Overview

CVE-2026-101009 is an OS command injection vulnerability in aaPanel BaoTa versions up to 11.8.0. The flaw resides in the panelTask.bt_task._unzip function within /www/server/panel/class/panelTask.py, part of the Unzip Handler component. Attackers can manipulate the Password argument to inject operating system commands [CWE-77]. The attack is executable over the network and a public proof-of-concept exploit has been disclosed. The vendor was contacted prior to public disclosure but did not respond.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on the hosting server by supplying a crafted Password value to the Unzip Handler, leading to full host compromise.

Affected Products

aaPanel BaoTa versions up to and including 11.8.0
Component: Unzip Handler (panelTask.py)
Function: panelTask.bt_task._unzip

Discovery Timeline

2026-09-28 - CVE-2026-101009 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database
2026-09-29 - EPSS scoring assigned (1.764%, 77th percentile)

Technical Details for CVE-2026-101009

Vulnerability Analysis

The vulnerability exists in the _unzip method of the panelTask.bt_task class, located in /www/server/panel/class/panelTask.py. This method handles archive extraction operations initiated through the BaoTa web control panel. When processing a user-supplied Password parameter for password-protected archives, the input is incorporated into a system command without adequate sanitization or safe parameter handling. An attacker who controls the Password field can append shell metacharacters to break out of the intended command context and execute arbitrary operating system instructions under the privileges of the panel service, which typically runs with elevated rights.

Root Cause

The underlying weakness is improper neutralization of special elements used in an OS command [CWE-77]. The _unzip routine constructs a shell command string that embeds the attacker-controlled Password value directly, rather than passing it as an isolated argument through a safe execution interface. Shell metacharacters such as ;, |, `, and $() are not stripped or escaped before command execution.

Attack Vector

Exploitation requires network access to the BaoTa panel and authenticated session context with privileges to trigger the Unzip Handler. A remote attacker submits a request to invoke the unzip task against a target archive and supplies a malicious Password value containing shell command separators followed by injected commands. The panel process then executes the injected payload on the host operating system. A public proof-of-concept has been published, lowering the barrier to exploitation.

See the GitHub Gist exploit code and VulDB CVE-2026-101009 details for technical specifics.

Detection Methods for CVE-2026-101009

Indicators of Compromise

Unexpected child processes spawned from the BaoTa panel Python process, particularly sh, bash, wget, curl, or nc invocations
Requests to the panel's unzip endpoint containing shell metacharacters (;, |, &&, `, $()) in the Password field
New or modified files under /www/server/panel/ outside of normal update windows
Outbound network connections from the panel server to unknown hosts following archive operations

Detection Strategies

Inspect panelTask logs and HTTP access logs for unzip task invocations with anomalous Password parameter contents
Monitor process lineage on servers running aaPanel BaoTa, flagging any shell interpreter spawned as a descendant of the panel process
Deploy web application firewall rules that identify command injection patterns in request bodies targeting panel task endpoints

Monitoring Recommendations

Enable auditd or equivalent kernel-level process auditing on BaoTa hosts to capture execve calls originating from the panel service
Forward panel access logs and host process telemetry to a centralized SIEM for correlation and retention
Alert on any file write activity to web-accessible directories by the panel process immediately following unzip tasks

How to Mitigate CVE-2026-101009

Immediate Actions Required

Restrict network exposure of the BaoTa panel interface to trusted administrative networks or VPN-only access
Audit panel user accounts and remove unnecessary administrative privileges that could be abused to reach the Unzip Handler
Review historical panel logs for suspicious unzip requests with anomalous Password values that may indicate prior exploitation
Isolate hosts running vulnerable BaoTa versions from sensitive internal network segments until mitigations are applied

Patch Information

At the time of publication, no vendor patch has been identified in the enriched CVE data. The vendor was reportedly contacted prior to public disclosure but did not respond. Administrators should monitor the official aaPanel project channels for an updated release above version 11.8.0 and apply it promptly when available. Refer to VulDB Vulnerability #410879 for ongoing status updates.

Workarounds

Disable or firewall off the panel's archive extraction functionality where operationally feasible until a vendor fix is released
Place the panel behind a reverse proxy that enforces strict input validation on the Password parameter and rejects shell metacharacters
Run the panel service under a least-privileged system account rather than root to limit the blast radius of successful command injection
Enforce multi-factor authentication on panel accounts to raise the bar for the authenticated access required to exploit this flaw

bash

# Example: restrict panel access with iptables to a trusted admin subnet
iptables -A INPUT -p tcp --dport 8888 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP