CVE-2026-107246 · Other
NO FIX YET · SEE WHAT TO DO
The Plesk "Site Import" extension before 1.13.2 does not validate domain and session identifiers, enabling path traversal. A non-owner subscription user can redirect a privileged backend session into a directory they control and run arbitrary code as root.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Plesk with the Site Import extension installed and older than 1.13.2 are exposed, particularly where customers hold subscriptions on the same server. Attackers must hold a non-owner subscription account on the host. Servers without the extension, or already on 1.13.2 or later, are not affected.
Not affected if auth-required, extension-not-installed
Who cares hosting-providers, plesk, self-hosted
1.13.21.13.2The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.