CVE-2026-113507: aaPanel, заобикаляне на вход и права

Описание

Оригинално описание

A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".

Засегнати продукти

• n/a aaPanel: 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18; 8.19; 8.20; 8.21; 8.22; 8.23; 8.24; 8.25.0

Вид слабост

• CWE-284 Неправилен контрол на достъпа
• CWE-266 Неправилно задаване на привилегии

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-113507
• https://nvd.nist.gov/vuln/detail/CVE-2026-113507
• https://vuldb.com/vuln/422749
• https://vuldb.com/vuln/422749/cti
• https://vuldb.com/cve/CVE-2026-113507
• https://vuldb.com/submit/996821
• https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip