aaPanel BaoTa File Merge Function Exposed to Remote Command Injection

A high-severity vulnerability (CVE-2026-101008, CVSS 8.5) has been discovered in aaPanel BaoTa up to version 11.8.0, impacting the merge_split_file function in the file /www/server/panel/class/files.py. According to the National Vulnerability Database (NVD), performing a manipulation of the argument split_file_path can result in remote command injection. The vulnerability, which has been made public, poses a significant risk to users of the affected software.

How does the vulnerability work?

The flaw lies in the merge_split_file function of the File Merge Handler component, where a manipulation of the split_file_path argument can lead to command injection. This means that an attacker could exploit this vulnerability to execute arbitrary commands on the affected system, potentially leading to full control over the server.

What should you do?

Given the severity of the vulnerability, it is imperative that users of aaPanel BaoTa up to version 11.8.0 take immediate action to mitigate the risk. While the vendor was contacted early about this disclosure, no fix has been confirmed yet.

What to do and how to stay safe: aaPanel BaoTa

• Patch scores alone ignore context like network exposure and asset criticality.
• You must map vulnerabilities to specific business risks to prioritize correctly.
• Continuous exposure data replaces static scanning for accurate prioritization.

Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.