Description
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WebPros | Plesk extension "Site Import" | < 1.13.2 | 1.13.2 |