CVE-2026-107246: Path Traversal
Published Nov 10, 2026
·Updated
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
Affected Software
1 affected component
Plesk Site Import<1.13.2
Event History
Nov 10, 2026
CVE Published
via MITRE·12:33 AM
Data Sourced
via MITRE·12:33 AM
DescriptionWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires a non-owner subscription user. No prior privileges are required beyond access as that type of user.
2
What is the impact if exploitation succeeds?
An attacker can redirect a privileged backend session into a directory they control through path traversal, leading to arbitrary code execution as root.
3
Which versions are affected?
Site Import versions before 1.13.2 are affected. The provided information does not identify any other affected or fixed product versions.