What’s Vulnerable › Vulnerabilities

CVE-2021-37840

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-02 · updated 2026-06-17

Description

aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).

Affected products

• Aapanel: through 6.8.12

References

• https://github.com/aaPanel/aaPanel/issues/74
• https://ssd-disclosure.com/ssd-advisory-aapanel-cswh-to-rce/
• https://github.com/aaPanel/aaPanel/issues/74
• https://ssd-disclosure.com/ssd-advisory-aapanel-cswh-to-rce/

Get alerted when CVE-2021-37840 or the next vulnerability affects your stack