medium5.3
CVE-2026-113507
A vulnerability was found in aaPanel up to 8.25.0.
Impact
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Affected products
| Product | Affected versions |
|---|---|
| AaPanel | before 8.25.0. |
Versions were read from the advisory text. No structured product data has been published for this record yet.