Path Traversal Vulnerability in Plesk Site Import Extension
CVE-2026-107246

9.2CRITICAL

Key Information:

Vendor

Webpros

Status
Plesk Extension "site Import"
Vendor
CVE Published:
10 November 2026

What is CVE-2026-107246?

The Plesk Site Import extension prior to version 1.13.2 is susceptible to path traversal due to inadequate validation of domain and session identifiers. This vulnerability enables unauthorized users to manipulate session data, potentially redirecting backend sessions to a directory of their choosing. As a consequence, attackers could execute arbitrary code with root privileges, compromising the integrity and security of the server.

Affected Version(s)

Plesk extension "Site Import" 0 < 1.13.2

References

https://support.plesk.com/hc/en-us/articles/4483108850152...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ady Elouej
.