PT-2026-141241
CVE-2026-107246
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Plesk extension "Site Import" versions prior to 1.13.2
Description
Insufficient validation of domain and session identifiers allows path traversal. This flaw enables a non-owner subscription user or a remote attacker without authentication to redirect a privileged backend session into a directory under their control, leading to arbitrary code execution with root privileges on the server.
Recommendations
Update Plesk extension "Site Import" to version 1.13.2.
Found an issue in the description? Have something to add? Feel free to write us 👾