Is aaPanel safe? An honest security review (2026)

aaPanel is safe enough for a personal or small business server if you harden it: keep the admin port closed to everyone but you, turn on two-factor authentication, update quickly and keep backups off the server. Out of the box, though, it has structural weak points. The panel process runs as root, every website runs as the same www user, and new vulnerabilities keep being published, including command injection reports in September and October 2026. If you host sites for many customers, those limits matter more than the feature list.

This review sticks to what we could verify in aaPanel's own documentation, its GitHub repository and NVD, at the time of writing (October 2026). We make a competing panel, ZoPanel, so we have tried to say clearly where aaPanel does well.

What aaPanel is

aaPanel is the international edition of BT Panel (宝塔面板, bt.cn), one of the most widely used server panels in China. The code still carries the BT names: the panel process is BT-Panel and the command line tool is bt. According to aaPanel's about page, it has released 200+ versions since 2017 and has been installed on more than 3,000,000 servers. There is a free edition and a paid Pro edition with a 14-day trial.

Its appeal is clear: one install script sets up nginx or Apache, PHP, MySQL, a file manager, cron, Docker and an app store in a friendly web interface. That breadth is also its attack surface: a file manager, a web terminal, database tools and a plugin system, all reachable from the panel's web port.

aaPanel's security history

These are aaPanel and BT Panel vulnerabilities we found on NVD or in a national vulnerability database. Versions are as listed in each record.

Published	CVE	Version	Bug	Login needed?
Jun 2020	CVE-2020-14421, CVE-2020-14950	through 6.6.6	Command execution via cron and the software store	Yes
Aug 2020	CNNVD-202008-1141 (report)	BT Panel Linux 7.4.2 (Chinese edition)	Unauthenticated access to phpMyAdmin	No
Aug 2021	CVE-2021-37840	through 6.8.12	Cross-site WebSocket hijacking of the web terminal	Victim must visit a page
Mar 2022	CVE-2022-26252	6.8.21	Directory traversal exposing root's SSH private key	Yes (CVSS PR:L)
May 2025	CVE-2024-42922	7.0.7	OS command injection (CVSS 6.5)	No (CVSS PR:N)
Mar 2026	CVE-2026-29859, CVE-2026-29858	7.57.0	File upload leading to code execution (CVSS 9.8); local file inclusion	No (CVSS PR:N)
Sep 2026	CVE-2026-101007, -101008, -101009	BaoTa up to 11.8.0 (Chinese edition)	OS command injection in database backup, file merge and unzip	Yes, admin (CVSS PR:H)
Oct 2026	CVE-2026-113506	aaPanel up to 8.25.0	OS command injection in the file manager	Yes (vendor and CVSS PR:L)
Oct 2026	CVE-2026-113507	aaPanel up to 8.25.0	Client IP taken from a spoofable X-Real-Ip header	No

Some context, to be fair:

• No aaPanel entry appears in CISA's Known Exploited Vulnerabilities catalog as of 20 October 2026. cPanel, CyberPanel and CWP all have entries there (see our timeline of hosting panel incidents).
• Many of the bugs need a login, which lowers the risk a lot if only you can log in. The exceptions matter: the March 2026 file upload flaw is scored as needing no login, which is why the panel port should not be public.
• Vendor response is mixed. For CVE-2026-113507 the NVD record quotes the vendor saying the issue "has already been fixed". For the September 2026 BaoTa reports, the record says the vendor "did not respond in any way". For CVE-2026-113506, NVD lists no fixed version at the time of writing.
• Reporting channel. The repository's SECURITY.md asks reporters to email a QQ address. There is no public advisory page we could find.

The pattern is the same as across the industry: command injection in code that runs as root, so an authenticated bug often becomes root on the server.

aaPanel's built-in security features

aaPanel has more security settings than many free panels. According to its Settings documentation:

Feature	What it does	Worth turning on?
Security Entrance	Login only works at a random path such as /021e887b	Keep it, but it is obscurity, not authentication
BasicAuth	An extra HTTP login in front of the panel	Yes, it stops scanners from reaching the panel code
Google Authenticator	TOTP code at login	Yes
Authorized IP	Panel only reachable from listed IPs	Yes, plus a firewall rule (see below)
Domain binding	Panel only answers on one domain; IP access gets 403	Useful against mass scans
Panel SSL	HTTPS for the panel (self-signed by default, Let's Encrypt possible)	Yes
Strong password, password expiry, timeout	Password rules and automatic logout	Yes
Alarms	Panel and SSH login alerts by email, Telegram, Discord, webhook and others	Yes

The Security page adds a system firewall with port, IP and region rules, SSH settings, brute-force protection for panel and SSH logins, compiler access limits, an Anti Intrusion module and System Hardening. That is a solid toolbox. The catch is that you have to turn it on and keep it on.

One detail matters: an IP allowlist inside the panel depends on the panel reading the client IP correctly. CVE-2026-113507 was exactly a client-IP bug, and HestiaCP had a similar one with CF-Connecting-IP. A firewall rule in the kernel does not have that weakness, so use both.

How aaPanel's architecture works

The panel runs as root

aaPanel's installer refuses to run as anything but root, and its service script init.sh starts the BT-Panel process directly, without switching to another user. So the web interface, the file manager and the terminal run with root's rights. That is convenient, since the panel can do anything, and it is why a bug like CVE-2022-26252 could read root's SSH key. Our article on why a hosting panel should not run as root explains the alternative.

All sites share the www user

When aaPanel creates a site, its code (class/panelSite.py) creates the folder with chmod -R 755 and chown -R www:www, then writes a .user.ini with open_basedir set to that site's folder and makes it immutable. Isolation between sites rests on PHP's open_basedir.

PHP's own manual is direct about this: open_basedir "is just an extra safety net, that is in no way comprehensive, and can therefore not be relied upon when security is needed." It also does not restrict Unix sockets. In practice, if one site is compromised and the attacker gets around open_basedir, every other site's files belong to the same user.

aaPanel has added sub-accounts with hosting packages. Its overview describes quotas for sites, databases and disk, but not separate Linux users or CPU and memory limits per user, so check on your own server before relying on it for customer isolation.

The install script skips certificate checks

At the time of writing, the install command on the download page fetches the script with curl -k or wget --no-check-certificate, which turns off TLS certificate verification. Older scripts on the same page use plain http://. A script that runs as root should be fetched over verified HTTPS, so download it yourself, check it, then run it.

How to harden aaPanel

If you keep using aaPanel, do these in order:

1. Update now and keep updating. Use Update on the panel home page, or bt 16 from SSH. Watch the aaPanel forum for releases.

2. Close the panel port to the internet. Allow only your IP at the firewall:

   sudo ufw allow from 203.0.113.7 to any port 7800 proto tcp   # use your panel port
   sudo ufw deny 7800/tcp
   

   Or use an SSH tunnel: ssh -L 7800:127.0.0.1:7800 root@server, then open https://127.0.0.1:7800 locally.

3. Turn on Google Authenticator, BasicAuth and Authorized IP, keep the Security Entrance, and change the default username and password.

4. Turn off what you do not use: the web terminal, unused plugins, public phpMyAdmin, the API.

5. Check PHP's disable_functions for every PHP version, so a hacked site cannot easily run shell commands.

6. Back up off the server. aaPanel's default backup folder is /www/backup on the same disk. Copy backups to S3 or another server with separate credentials.

7. Turn on login alarms for the panel and SSH, sent to Telegram or email.

8. Check for compromise now and then: extra UID 0 users (awk -F: '$3==0' /etc/passwd), unknown cron jobs, unknown processes and PHP files in upload folders.

These steps work for any panel. More on the server side is in how to secure an Ubuntu VPS.

When to consider an alternative

A hardened aaPanel is a reasonable choice for your own sites on one server, where you are the only person who logs in. Consider something else if:

• you host sites for customers, and one customer's hacked WordPress must not reach another customer's files;
• you cannot keep the panel port private, for example because customers log in from anywhere;
• you need per-account CPU, memory and process limits, so one site cannot slow the whole server;
• you need an audit trail for clients or compliance, or verified installs and updates.

Our aaPanel alternatives guide compares HestiaCP, CloudPanel, cPanel and ZoPanel and shows how to move sites. In ZoPanel, the web panel runs as an unprivileged user and a root agent accepts only a fixed list of actions; each account is its own Linux user with its own PHP-FPM pool and a systemd slice with CPU, memory and process limits; installs and updates are signature-checked. Details are on the security features page and in the security docs. ZoPanel is younger, has a smaller ecosystem and fewer one-click apps than aaPanel, runs only on Ubuntu and Debian, and cannot import aaPanel backups directly. It will have bugs too; the design aims to keep each one smaller.

Conclusion

aaPanel is not unsafe by nature, and it gives you many of the right tools. Its risks come from a root-run panel, a shared www user for all sites and a steady flow of CVEs, so how safe it is depends on you closing the port, enabling 2FA, updating fast and keeping backups elsewhere. For one personal server, that is manageable. For customer hosting, per-account isolation is worth more than any feature.

If you want to compare on a test VPS, ZoPanel's Free plan covers 3 hosting accounts, 10 websites and 10 databases with no time limit.

Frequently asked questions

Is aaPanel safe to use in 2026?

It can be, with care. It has known vulnerabilities, including a file upload flaw scored as needing no login in March 2026 and new command injection reports in October 2026, but none is in CISA's exploited list. Keep it updated, restrict the panel port to your IP, and enable Google Authenticator and BasicAuth.

Is aaPanel Chinese software?

Yes. aaPanel is the international edition of BT Panel (宝塔面板) from bt.cn in China, and its code still uses the BT names. Being Chinese does not make it unsafe by itself; judge it on its code, update practice and how it handles vulnerability reports.

Does aaPanel run as root?

Yes. The service script starts the BT-Panel process as root without dropping privileges, so the web interface, file manager and terminal have full control of the server. That is why panel bugs tend to have root impact.

Can one hacked website infect other sites on aaPanel?

It can. All sites run as the same www user and are separated mainly by PHP's open_basedir, which PHP's manual says cannot be relied on for security. Keep disable_functions strict and scan sites regularly; for customer hosting, use a panel with a separate Linux user per account.

What is the aaPanel security entrance?

It is a random path, such as /021e887b, that must be part of the login URL. It hides the login page from simple scanners, but it is not a password and leaks easily through browser history or logs. Use it together with 2FA, BasicAuth and a firewall rule on the panel port.