Path Traversal Vulnerability in Plesk’s Backup Manager by Plesk
CVE-2026-68487

9.9CRITICAL

Key Information:

Vendor

Webpros

Status
Plesk
Vendor
CVE Published:
10 September 2026

What is CVE-2026-68487?

Plesk’s Backup Manager is vulnerable to a path traversal issue that allows an authenticated user to manipulate backup header files. This vulnerability enables unauthorized file write access to the root directory, potentially leading to serious data breaches and system compromises. Users are advised to apply the latest security updates and follow best practices to safeguard their systems.

Affected Version(s)

Plesk 0 <= 18.0.80.6

Plesk 0 <= 18.0.79.10

References

https://support.plesk.com/hc/en-us/articles/4324884163855...

CVSS V3.0

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.