A critical local file inclusion vulnerability in aaPanel v7.57.0 allows unauthenticated attackers to access sensitive files, posing a significant risk of information disclosure.

The software fails to implement proper path validation, resulting in a local file inclusion vulnerability. This flaw is accessible to unauthenticated remote attackers.

The ability to perform local file inclusion allows an attacker to read arbitrary files from the server filesystem, including configuration files, credentials, or sensitive system data. This leads to a total loss of confidentiality regarding the server environment. With a CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent unauthorized data exfiltration and potential escalation of privileges.

Immediate Action: Restrict access to the aaPanel management interface to trusted IP addresses only and disable public-facing access until a vendor-supplied security patch is applied.

Proactive Monitoring: Review web server and application access logs for unusual request patterns, specifically looking for directory traversal sequences like dot-dot-slash characters in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting the management interface.

Public Exploit Available: Yes, a published PoC exists, as documented in the security researcher write-up referenced in the CVE record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate threat to server integrity. Administrators should prioritize isolating the affected management interface from the public internet and closely monitor for unauthorized access attempts until an official patch is released and applied.