CVE-2026-29858

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada aapanel. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2026-29858 exploit · advisory pihak ketiga
• https://github.com/aapanel/aapanel product