CVE-2026-101008: aaPanel BaoTa: command injection in file merge handler

aaPanel (BaoTa) up to 11.8.0 has an OS command injection in the file merge handler (merge_split_file in files.py), reachable remotely through the split_file_path argument. The flaw needs high privileges, so it is mainly a post-authentication escalation or insider risk. Even so, a public exploit write-up is linked in the references, the vendor has not responded to the disclosure, and no patched version exists. EPSS is low (0.023, top 17%), it is not in CISA KEV, and CISA SSVC rates it ATTEND. Note that the panel is a general web hosting control panel, not a tracked AI package, and the 'ml_ui' category looks like a misclassification, so it matters only where it hosts ML workloads or notebooks. Restrict panel access to trusted networks or a VPN, audit and rotate admin credentials, remove the panel from the internet, and monitor for unusual shell activity from the panel's Python process until the vendor ships a fix.

Proof-of-concept exploit code is publicly available for CVE-2026-101008, increasing the risk of exploitation.

1) No patched version is published, so check the vendor's channels for releases after 11.8.0 and apply them as soon as they exist. 2) Do not expose the panel to the internet. Restrict it by firewall, IP allow-list or VPN, and change the default port. 3) Enforce strong, unique admin credentials with MFA where available, and review admin accounts and sessions. 4) Monitor for requests to the file merge endpoint with unusual split_file_path values (shell metacharacters such as ;, |, $(), backticks). Alert on child shells spawned by the panel's Python process. 5) Review the public exploit write-up to build detections. 6) Isolate ML workloads from the panel host, and rotate secrets stored on it if compromise is suspected. 7) Consider migrating to a maintained alternative if the vendor stays unresponsive.

This vulnerability affects the following AI/ML architecture patterns: Web hosting control panels hosting ML workloads, Self-hosted notebook and model-serving hosts.

CVE-2026-101008 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 2.34%.