CVE-2026-67397 in Plesk
Summary
by MITRE • 09/04/2026
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified involves a critical path traversal flaw within the Plesk control panel software, specifically affecting versions 18.0.79.9 and earlier, as well as version ranges from 18.0.80 through 18.0.80.5. This security defect allows local users to execute arbitrary code with root privileges, representing a severe escalation of privilege scenario. The core technical issue stems from insufficient validation or sanitization of file paths provided by the user during specific administrative operations within the Plesk interface. When an authenticated local user interacts with certain components of the application, they can manipulate input parameters to traverse directory boundaries using standard path traversal sequences such as dot-dot-slash characters. This manipulation enables the attacker to direct system processes toward sensitive files or executable binaries located outside the intended web root or restricted directories.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability arises because the application fails to properly canonicalize user-supplied input before using it in file system operations. By constructing maliciously crafted paths that escape the designated sandbox or working directory, an attacker can cause the underlying server processes to read, write, or execute files with elevated permissions. Since Plesk often runs background services and administrative scripts with high-level privileges to manage hosting environments, exploiting this path traversal allows a low-privilege local user to inject commands into these privileged contexts. The execution of arbitrary code as root effectively grants the attacker full control over the compromised server, including access to all hosted websites, databases, configuration files, and system binaries.
The operational impact of this vulnerability is profound for any organization relying on Plesk for web hosting management. An adversary who exploits this flaw can achieve complete compromise of the host operating system. This includes the ability to exfiltrate sensitive data such as customer credentials, SSL certificates, database contents, and proprietary application source code stored within the hosted environments. Furthermore, root access enables the installation of persistent backdoors, rootkits, or cryptominers that are difficult to detect using standard security monitoring tools. The attacker can also pivot from this compromised host to other systems on the internal network by leveraging trust relationships or exposed services, thereby expanding the scope of the breach significantly beyond the initial entry point.
This vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation and Command and Control via Local File Inclusion or Path Traversal mechanisms. Specifically, it facilitates lateral movement within a multi-tenant hosting environment where one compromised account can impact others due to shared root-level resources. The exploitation typically requires local authentication, meaning the attacker must first gain access to an existing user account on the server through other means such as weak credentials, phishing, or exploiting other web application vulnerabilities in hosted sites. Once authenticated locally, the path traversal flaw serves as a powerful tool for escalating privileges from a standard user to root without requiring additional external network-based exploits.
Mitigation strategies must focus primarily on immediate patching and rigorous access control enforcement. Administrators should upgrade Plesk to version 18.0.80.6 or later, where the vendor has implemented fixes to properly validate and sanitize file path inputs before processing them in system calls. In environments where upgrading is not immediately feasible, implementing strict firewall rules to restrict local network access to administrative interfaces can reduce the attack surface. Additionally, enforcing principle of least privilege by ensuring that web hosting accounts operate with minimal necessary permissions can limit the potential impact if a separate vulnerability allows initial code execution or file upload within those constrained contexts. Regular auditing of system logs for unusual path traversal attempts and monitoring for unauthorized root-level process executions are also recommended defensive measures to detect exploitation activity early.