23 Oct 2026 15:48:27 UTC
aaPanel BaoTa Database Backup database.py InputSql os command injection
cve-program · CVE-2026-101007 · Published
CVE-2026-101007
aaPanel BaoTa Database Backup database.py InputSql os command injection
CVSS 4.0 9.3 CRITICALCVSS 3.1 8.4 HIGHCVSS 3.0 8.4 HIGHCVSS 2.0 8.3 Check source for fixed versionsKEV status unknown
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-101007
PublishedA vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
1 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
This historical link shows only this version and versions saved before it. Browse all advisory history.