CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-101008 — A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the functio...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted ear

Analysis

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 9.1. Published: 2026-09-28T07:17:20.403.

Indicators of Compromise (1)

CVE (1)
CVE-2026-101008
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Malicious Linux Implants Mimic Asian Mail Security Products

A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.

Dark Reading
MEDIUMVulnerabilityNEW

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]

BleepingComputer
LOWVulnerability

Crypto Scammers Hijack Microsoft’s Official X Account

Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account. The post Crypto Scammers Hijack Microsoft’s Official X Account appeared first on SecurityWeek .

SecurityWeek