# Is aaPanel safe? An honest security review (2026)

> Is aaPanel safe? We review its CVE history, built-in security features, root-run architecture and site isolation, with hardening steps for 2026.

Source: https://zopanel.net/blog/is-aapanel-safe  
Updated: 2026-10-21

## Key takeaways

- aaPanel ships many useful protections (security entrance, BasicAuth, 2FA, authorized IPs, firewall), but several stay off until you turn them on.
- The panel process runs as root and all sites share the www user, so a panel bug or one hacked site can reach far.
- It has a steady CVE record, including new command injection reports in September and October 2026, though none is in CISA's exploited list.
- For one personal server, a hardened aaPanel is reasonable; for hosting many customers, choose a panel with per-account isolation.

aaPanel is safe enough for a personal or small business server if you harden it: keep the admin port closed to everyone but you, turn on two-factor authentication, update quickly and keep backups off the server. Out of the box, though, it has structural weak points. The panel process runs as root, every website runs as the same `www` user, and new vulnerabilities keep being published, including command injection reports in September and October 2026. If you host sites for many customers, those limits matter more than the feature list.

This review sticks to what we could verify in aaPanel's own documentation, its [GitHub repository](https://github.com/aaPanel/aaPanel) and [NVD](https://nvd.nist.gov/), at the time of writing (October 2026). We make a competing panel, ZoPanel, so we have tried to say clearly where aaPanel does well.

## What aaPanel is

aaPanel is the international edition of BT Panel (宝塔面板, bt.cn), one of the most widely used server panels in China. The code still carries the BT names: the panel process is `BT-Panel` and the command line tool is `bt`. According to [aaPanel's about page](https://www.aapanel.com/new/about.html), it has released 200+ versions since 2017 and has been installed on more than 3,000,000 servers. There is a free edition and a paid Pro edition with a 14-day trial.

Its appeal is clear: one install script sets up nginx or Apache, PHP, MySQL, a file manager, cron, Docker and an app store in a friendly web interface. That breadth is also its attack surface: a file manager, a web terminal, database tools and a plugin system, all reachable from the panel's web port.

## aaPanel's security history

These are aaPanel and BT Panel vulnerabilities we found on NVD or in a national vulnerability database. Versions are as listed in each record.

| Published | CVE | Version | Bug | Login needed? |
|---|---|---|---|---|
| Jun 2020 | [CVE-2020-14421](https://nvd.nist.gov/vuln/detail/CVE-2020-14421), [CVE-2020-14950](https://nvd.nist.gov/vuln/detail/CVE-2020-14950) | through 6.6.6 | Command execution via cron and the software store | Yes |
| Aug 2020 | CNNVD-202008-1141 ([report](https://www.secrss.com/articles/24965)) | BT Panel Linux 7.4.2 (Chinese edition) | Unauthenticated access to phpMyAdmin | No |
| Aug 2021 | [CVE-2021-37840](https://nvd.nist.gov/vuln/detail/CVE-2021-37840) | through 6.8.12 | Cross-site WebSocket hijacking of the web terminal | Victim must visit a page |
| Mar 2022 | [CVE-2022-26252](https://nvd.nist.gov/vuln/detail/CVE-2022-26252) | 6.8.21 | Directory traversal exposing root's SSH private key | Yes (CVSS PR:L) |
| May 2025 | [CVE-2024-42922](https://nvd.nist.gov/vuln/detail/CVE-2024-42922) | 7.0.7 | OS command injection (CVSS 6.5) | No (CVSS PR:N) |
| Mar 2026 | [CVE-2026-29859](https://nvd.nist.gov/vuln/detail/CVE-2026-29859), [CVE-2026-29858](https://nvd.nist.gov/vuln/detail/CVE-2026-29858) | 7.57.0 | File upload leading to code execution (CVSS 9.8); local file inclusion | No (CVSS PR:N) |
| Sep 2026 | [CVE-2026-101007](https://nvd.nist.gov/vuln/detail/CVE-2026-101007), [-101008](https://nvd.nist.gov/vuln/detail/CVE-2026-101008), [-101009](https://nvd.nist.gov/vuln/detail/CVE-2026-101009) | BaoTa up to 11.8.0 (Chinese edition) | OS command injection in database backup, file merge and unzip | Yes, admin (CVSS PR:H) |
| Oct 2026 | [CVE-2026-113506](https://nvd.nist.gov/vuln/detail/CVE-2026-113506) | aaPanel up to 8.25.0 | OS command injection in the file manager | Yes (vendor and CVSS PR:L) |
| Oct 2026 | [CVE-2026-113507](https://nvd.nist.gov/vuln/detail/CVE-2026-113507) | aaPanel up to 8.25.0 | Client IP taken from a spoofable `X-Real-Ip` header | No |

Some context, to be fair:

- **No aaPanel entry appears in CISA's [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)** as of 20 October 2026. cPanel, CyberPanel and CWP all have entries there (see our [timeline of hosting panel incidents](/blog/hosting-panel-security-incidents)).
- **Many of the bugs need a login,** which lowers the risk a lot if only you can log in. The exceptions matter: the March 2026 file upload flaw is scored as needing no login, which is why the panel port should not be public.
- **Vendor response is mixed.** For CVE-2026-113507 the NVD record quotes the vendor saying the issue "has already been fixed". For the September 2026 BaoTa reports, the record says the vendor "did not respond in any way". For CVE-2026-113506, NVD lists no fixed version at the time of writing.
- **Reporting channel.** The repository's [SECURITY.md](https://github.com/aaPanel/aaPanel/blob/master/SECURITY.md) asks reporters to email a QQ address. There is no public advisory page we could find.

The pattern is the same as across the industry: command injection in code that runs as root, so an authenticated bug often becomes root on the server.

## aaPanel's built-in security features

aaPanel has more security settings than many free panels. According to its [Settings documentation](https://www.aapanel.com/docs/Function/Settings.html):

| Feature | What it does | Worth turning on? |
|---|---|---|
| Security Entrance | Login only works at a random path such as `/021e887b` | Keep it, but it is obscurity, not authentication |
| BasicAuth | An extra HTTP login in front of the panel | Yes, it stops scanners from reaching the panel code |
| Google Authenticator | TOTP code at login | Yes |
| Authorized IP | Panel only reachable from listed IPs | Yes, plus a firewall rule (see below) |
| Domain binding | Panel only answers on one domain; IP access gets 403 | Useful against mass scans |
| Panel SSL | HTTPS for the panel (self-signed by default, Let's Encrypt possible) | Yes |
| Strong password, password expiry, timeout | Password rules and automatic logout | Yes |
| Alarms | Panel and SSH login alerts by email, Telegram, Discord, webhook and others | Yes |

The [Security page](https://www.aapanel.com/docs/Function/Security.html) adds a system firewall with port, IP and region rules, SSH settings, brute-force protection for panel and SSH logins, compiler access limits, an Anti Intrusion module and System Hardening. That is a solid toolbox. The catch is that you have to turn it on and keep it on.

One detail matters: an IP allowlist inside the panel depends on the panel reading the client IP correctly. CVE-2026-113507 was exactly a client-IP bug, and HestiaCP had a similar one with `CF-Connecting-IP`. A firewall rule in the kernel does not have that weakness, so use both.

## How aaPanel's architecture works

### The panel runs as root

aaPanel's installer refuses to run as anything but root, and its service script [`init.sh`](https://github.com/aaPanel/aaPanel/blob/master/init.sh) starts the `BT-Panel` process directly, without switching to another user. So the web interface, the file manager and the terminal run with root's rights. That is convenient, since the panel can do anything, and it is why a bug like CVE-2022-26252 could read root's SSH key. Our article on [why a hosting panel should not run as root](/blog/secure-hosting-panel-architecture) explains the alternative.

### All sites share the www user

When aaPanel creates a site, its code ([`class/panelSite.py`](https://github.com/aaPanel/aaPanel/blob/master/class/panelSite.py)) creates the folder with `chmod -R 755` and `chown -R www:www`, then writes a `.user.ini` with `open_basedir` set to that site's folder and makes it immutable. Isolation between sites rests on PHP's `open_basedir`.

PHP's own [manual](https://www.php.net/manual/en/ini.core.php) is direct about this: `open_basedir` "is just an extra safety net, that is in no way comprehensive, and can therefore not be relied upon when security is needed." It also does not restrict Unix sockets. In practice, if one site is compromised and the attacker gets around `open_basedir`, every other site's files belong to the same user.

aaPanel has added sub-accounts with hosting packages. Its [overview](https://www.aapanel.com/docs/SubaaPanel/Overview.html) describes quotas for sites, databases and disk, but not separate Linux users or CPU and memory limits per user, so check on your own server before relying on it for customer isolation.

### The install script skips certificate checks

At the time of writing, the install command on the [download page](https://www.aapanel.com/new/download.html) fetches the script with `curl -k` or `wget --no-check-certificate`, which turns off TLS certificate verification. Older scripts on the same page use plain `http://`. A script that runs as root should be fetched over verified HTTPS, so download it yourself, check it, then run it.

## How to harden aaPanel

If you keep using aaPanel, do these in order:

1. **Update now and keep updating.** Use **Update** on the panel home page, or `bt 16` from SSH. Watch the [aaPanel forum](https://forum.aapanel.com/) for releases.
2. **Close the panel port to the internet.** Allow only your IP at the firewall:

   ```bash
   sudo ufw allow from 203.0.113.7 to any port 7800 proto tcp   # use your panel port
   sudo ufw deny 7800/tcp
   ```

   Or use an SSH tunnel: `ssh -L 7800:127.0.0.1:7800 root@server`, then open `https://127.0.0.1:7800` locally.
3. **Turn on Google Authenticator, BasicAuth and Authorized IP**, keep the Security Entrance, and change the default username and password.
4. **Turn off what you do not use:** the web terminal, unused plugins, public phpMyAdmin, the API.
5. **Check PHP's `disable_functions`** for every PHP version, so a hacked site cannot easily run shell commands.
6. **Back up off the server.** aaPanel's default backup folder is `/www/backup` on the same disk. Copy backups to S3 or another server with separate credentials.
7. **Turn on login alarms** for the panel and SSH, sent to Telegram or email.
8. **Check for compromise now and then:** extra UID 0 users (`awk -F: '$3==0' /etc/passwd`), unknown cron jobs, unknown processes and PHP files in upload folders.

These steps work for any panel. More on the server side is in [how to secure an Ubuntu VPS](/blog/secure-ubuntu-vps).

## When to consider an alternative

A hardened aaPanel is a reasonable choice for your own sites on one server, where you are the only person who logs in. Consider something else if:

- **you host sites for customers**, and one customer's hacked WordPress must not reach another customer's files;
- **you cannot keep the panel port private**, for example because customers log in from anywhere;
- **you need per-account CPU, memory and process limits**, so one site cannot slow the whole server;
- **you need an audit trail** for clients or compliance, or verified installs and updates.

Our [aaPanel alternatives guide](/blog/aapanel-alternative) compares HestiaCP, CloudPanel, cPanel and ZoPanel and shows how to move sites. In ZoPanel, the web panel runs as an unprivileged user and a root agent accepts only a fixed list of actions; each account is its own Linux user with its own PHP-FPM pool and a systemd slice with CPU, memory and process limits; installs and updates are signature-checked. Details are on the [security features page](/features/security) and in the [security docs](/docs/security). ZoPanel is younger, has a smaller ecosystem and fewer one-click apps than aaPanel, runs only on Ubuntu and Debian, and cannot import aaPanel backups directly. It will have bugs too; the design aims to keep each one smaller.

## Conclusion

aaPanel is not unsafe by nature, and it gives you many of the right tools. Its risks come from a root-run panel, a shared `www` user for all sites and a steady flow of CVEs, so how safe it is depends on you closing the port, enabling 2FA, updating fast and keeping backups elsewhere. For one personal server, that is manageable. For customer hosting, per-account isolation is worth more than any feature.

If you want to compare on a test VPS, [ZoPanel's Free plan](/pricing) covers 3 hosting accounts, 10 websites and 10 databases with no time limit.

## Frequently asked questions

### Is aaPanel safe to use in 2026?

It can be, with care. It has known vulnerabilities, including a file upload flaw scored as needing no login in March 2026 and new command injection reports in October 2026, but none is in CISA's exploited list. Keep it updated, restrict the panel port to your IP, and enable Google Authenticator and BasicAuth.

### Is aaPanel Chinese software?

Yes. aaPanel is the international edition of BT Panel (宝塔面板) from bt.cn in China, and its code still uses the BT names. Being Chinese does not make it unsafe by itself; judge it on its code, update practice and how it handles vulnerability reports.

### Does aaPanel run as root?

Yes. The service script starts the `BT-Panel` process as root without dropping privileges, so the web interface, file manager and terminal have full control of the server. That is why panel bugs tend to have root impact.

### Can one hacked website infect other sites on aaPanel?

It can. All sites run as the same `www` user and are separated mainly by PHP's `open_basedir`, which PHP's manual says cannot be relied on for security. Keep `disable_functions` strict and scan sites regularly; for customer hosting, use a panel with a separate Linux user per account.

### What is the aaPanel security entrance?

It is a random path, such as `/021e887b`, that must be part of the login URL. It hides the login page from simple scanners, but it is not a password and leaks easily through browser history or logs. Use it together with 2FA, BasicAuth and a firewall rule on the panel port.