{"id":"CVE-2026-107246","kind":"vulnerability","aliases":["CVE-2026-107246"],"related":[],"title":"Plesk Site Import extension: path traversal lets subscription users run code as root","description":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.","summary":"The Plesk \"Site Import\" extension before 1.13.2 does not validate domain and session identifiers, enabling path traversal. A non-owner subscription user can redirect a privileged backend session into a directory they control and run arbitrary code as root.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hosting-providers","other","plesk","self-hosted"],"not_affected_if":["auth-required","extension-not-installed"],"how_to_check":"- Check the installed version of the Site Import extension in Plesk (Extensions) and see whether it is below `1.13.2`","fix":"- Plesk Site Import extension: `1.13.2`","status":"open","published_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:14+00:00","updated_at":"2026-11-10T01:28:14+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T01:28:14Z","model":"claude-haiku-5-5","output":{"fix":"- Plesk Site Import extension: `1.13.2`","reach":"local","title":"Plesk Site Import extension: path traversal lets subscription users run code as root","impact":"high","summary":"The Plesk \"Site Import\" extension before 1.13.2 does not validate domain and session identifiers, enabling path traversal. A non-owner subscription user can redirect a privileged backend session into a directory they control and run arbitrary code as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["plesk","self-hosted","hosting-providers"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as root on the server","analyst_note":"Confirm the affected version range and any vendor advisory for CVE-2026-107246; sources list only NVD.","how_to_check":"- Check the installed version of the Site Import extension in Plesk (Extensions) and see whether it is below `1.13.2`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["extension-not-installed","auth-required"],"who_is_affected":"Servers running Plesk with the Site Import extension installed and older than 1.13.2 are exposed, particularly where customers hold subscriptions on the same server. Attackers must hold a non-owner subscription account on the host. Servers without the extension, or already on 1.13.2 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4544,"output_tokens":546,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107246':16A,19A '-2026':15A,18A '1.13.2':34B,74C 'allow':83C 'arbitrari':64B,106C 'backend':55B,97C 'code':11A,65B,107C 'control':61B,103C 'cve':14A,17A 'directori':59B,101C 'domain':38B,79C 'enabl':42B 'execut':108C 'extens':4A,32B,70C 'host':21B,27B 'hosting-provid':20B 'identifi':41B,82C 'import':3A,31B,72C 'let':7A,87C 'non':47B,90C 'non-own':46B,89C 'owner':48B,91C 'path':5A,43B,84C 'plesk':1A,24B,29B,69C 'privileg':54B,96C 'proper':77C 'provid':22B 'redirect':52B,94C 'result':104C 'root':13A,67B,110C 'run':10A,63B 'self':26B 'self-host':25B 'session':40B,56B,81C,98C 'site':2A,30B,71C 'subscript':8A,49B,92C 'travers':6A,44B,85C 'user':9A,50B,93C 'valid':37B,78C","nicknames":[],"mitigations":[],"who_affected":"Servers running Plesk with the Site Import extension installed and older than 1.13.2 are exposed, particularly where customers hold subscriptions on the same server. Attackers must hold a non-owner subscription account on the host. Servers without the extension, or already on 1.13.2 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","hostingproviders","other","plesk","selfhosted"],"campaign_type":null,"search_a":"'-107246':16A,19A '-2026':15A,18A 'code':11A 'cve':14A,17A 'extens':4A 'import':3A 'let':7A 'path':5A 'plesk':1A 'root':13A 'run':10A 'site':2A 'subscript':8A 'travers':6A 'user':9A","search_b":"'1.13.2':34B 'arbitrari':64B 'backend':55B 'code':65B 'control':61B 'directori':59B 'domain':38B 'enabl':42B 'extens':32B 'host':21B,27B 'hosting-provid':20B 'identifi':41B 'import':31B 'non':47B 'non-own':46B 'owner':48B 'path':43B 'plesk':24B,29B 'privileg':54B 'provid':22B 'redirect':52B 'root':67B 'run':63B 'self':26B 'self-host':25B 'session':40B,56B 'site':30B 'subscript':49B 'travers':44B 'user':50B 'valid':37B","search_c":"'1.13.2':74C 'allow':83C 'arbitrari':106C 'backend':97C 'code':107C 'control':103C 'directori':101C 'domain':79C 'execut':108C 'extens':70C 'identifi':82C 'import':72C 'let':87C 'non':90C 'non-own':89C 'owner':91C 'path':84C 'plesk':69C 'privileg':96C 'proper':77C 'redirect':94C 'result':104C 'root':110C 'session':81C,98C 'site':71C 'subscript':92C 'travers':85C 'user':93C 'valid':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107246","severity":null,"published_at":"2026-11-10T01:17:12+00:00","modified_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}