CVE-2026-48614: Code Injection
Published Jul 6, 2026
·Updated
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Affected Software
1 affected component
Plesk Plesk XML API
Event History
Jul 6, 2026
CVE Published
via MITRE·04:46 PM
Data Sourced
via MITRE·04:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-48614?
CVE-2026-48614 has a critical severity rating of 9.9.
2
What does CVE-2026-48614 affect?
CVE-2026-48614 affects the Plesk XML API and involves improper authorization that allows for file write as root.
3
How do I fix CVE-2026-48614?
To fix CVE-2026-48614, ensure that your Plesk installation is updated to the latest version that addresses this vulnerability.
4
What are the potential consequences of CVE-2026-48614?
The consequences include arbitrary file write as root and full privilege escalation on the underlying server.
5
Who is affected by CVE-2026-48614?
Any authenticated user of the Plesk XML API might exploit CVE-2026-48614 if not properly mitigated.