CVE-2026-107246
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
| CWE | CWE-22 |
| Vendor | webpros |
| Product | plesk extension "site import" |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for webpros plesk extension "site import"
Be the first to know when new unknown vulnerabilities affecting webpros plesk extension "site import" are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
WebPros / Plesk extension "Site Import"
0 < 1.13.2
References
Credits
Ady Elouej