CVE-2026-107246

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal.

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-107246