Description
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WebPros | Plesk | ≤ 18.0.80.6, ≤ 18.0.79.10 | — |
Critical · 9.9
CVE-2026-68487
EUVD-2026-75596GHSA-m444-4f6f-9m89
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
Published Sep 10, 2026 · Updated Sep 10, 2026 · Assigned by hackerone