CVE-2026-107246

CriticalCVSS 9.2/10Last modified Nov 12, 2026

Description

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

Metrics

CVSS 4.0 9.2/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
WebProsPlesk extension "Site Import"< 1.13.2

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1072478.1An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify CVE-2026-1072488.8Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user wCVE-2026-1072499.8Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. TCVE-2026-107257.5Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size CVE-2026-1072505.9Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.CVE-2026-1072516.5Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects EntitCVE-2026-1072525.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allowCVE-2026-1072535.9Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.CVE-2026-1072544.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication BypassCVE-2026-1072557.3Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versiCVE-2026-1072565.3Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versiCVE-2026-1072576.5Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0
CVE-2026-107246: Critical severity, CVSS 9.2 | Vulnix