CriticalCritical vulnerability

CVE-2026-107246 (CVSS 9.2)

NVD · officialPublished Nov 10, 2026Risk 50/100

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

Technical details

CVSS

9.2

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source