Skip to content
OpenAdvisories
High · 8.7 CVE-2026-68492 EUVD-2026-85621GHSA-9584-9pgw-4m7q

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated user…

Published Sep 23, 2026 · Updated Sep 24, 2026 · Assigned by hackerone

Vendor: WebPros Product: Plesk Product: Plesk extension "Plesk RESTful API"

Description

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Affected products

VendorProductAffectedFixed
WebPros Plesk 18.0.34 – < 18.0.80.8, 18.0.81 – < 18.0.81.1 18.0.80.8
WebPros Plesk extension "Plesk RESTful API" 2.4.2 – < 2.4.7 2.4.7

References