CVE-2026-29858

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-29858", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-19T14:24:44.583Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T17:22:06.270Z"}, "descriptions": [{"lang": "en", "value": "A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/aapanel/aapanel"}, {"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2026-29858"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-98", "lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T14:22:07.268793Z", "id": "CVE-2026-29858", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:24:44.583Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-29858", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T14:22:07.268793Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:24:34.498Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/aapanel/aapanel"}, {"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2026-29858"}], "descriptions": [{"lang": "en", "value": "A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-18T17:22:06.270Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29858", "state": "PUBLISHED", "dateUpdated": "2026-03-19T14:24:44.583Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-18T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aapanel:aapanel:7.57.0:*:*:*:*:*:*:*", "matchCriteriaId": "BEA5AFC6-F733-4683-A374-C9665E0A2250", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure."}, {"lang": "es", "value": "Una falta de validaci\u00f3n de rutas en aaPanel v7.57.0 permite a los atacantes ejecutar una inclusi\u00f3n local de ficheros (LFI), lo que lleva a la exposici\u00f3n de informaci\u00f3n sensible."}], "id": "CVE-2026-29858", "lastModified": "2026-06-17T10:29:54.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29858", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T14:22:07.268793Z", "version": "2.0.3"}}]}, "published": "2026-03-18T18:16:27.230", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/aapanel/aapanel"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2026-29858"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.57.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "aapanel", "vendor": "aapanel"}], "analysis": {"en": {"generated_at": "2026-03-19T20:25:44.098274+00:00", "value": {"mitigation_remediation": ["Check the aaPanel vendor website or repository for an updated version that addresses the LFI flaw", "If a patch is not yet available, restrict external access to the aaPanel web interface via firewall rules"], "summary": {"action": "Apply Patch", "impact": "Local File Inclusion leading to information disclosure"}, "threat_synthesis": {"affected_systems": "Only aaPanel 7.57.0 is affected. No other versions or vendors are listed as impacted.", "description_and_impact": "The vulnerability exists in aaPanel version 7.57.0 due to insufficient path validation. This flaw allows an attacker to execute a local file inclusion (LFI), which can expose sensitive information stored on the server. The weakness maps to CWE\u201198, indicating a failure to restrict file inclusion to trusted paths. Files outside the intended directory could be read or executed, compromising data confidentiality and potentially enabling further exploitation.", "risk_and_exploitability": "The CVSS score of 7.5 classifies the issue as high severity, while an EPSS score of less than 1% suggests low current exploitation probability. This vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack vector involves invoking the web interface of aaPanel; the lack of path validation is likely exploitable remotely by anyone who can send crafted requests to the affected endpoint. Attackers could read arbitrary local files, leading to confidentiality loss or execution of arbitrary code if files are executed."}}}}, "created": "2026-03-19T08:57:05.199273+00:00", "title": "Local File Inclusion via Path Validation in aaPanel v7.57.0", "updated": "2026-03-24T10:54:05.457498+00:00", "vendors": ["aapanel", "aapanel$PRODUCT$aapanel"]}