GHSA-vvxf-x39h-gvfpMediumCVSS 5.3
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function...
🔗 CVE IDs covered (1)
📋 Description
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-113507
- https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip
- https://vuldb.com/cve/CVE-2026-113507
- https://vuldb.com/submit/996821
- https://vuldb.com/vuln/422749
- https://vuldb.com/vuln/422749/cti
- https://github.com/advisories/GHSA-vvxf-x39h-gvfp