CVE-2026-107246 The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backen...
CriticalCVSS 9.2
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WebPros Plesk extension "Site Import" | < 1.13.2 | 1.13.2 |