EUVD-2026-66761
GHSA-6rh7-pjg5-mhwh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible Plesk panel (AV:N), low-privilege account required (PR:L), root execution constitutes scope change (S:C) with full host impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
AnalysisAI
Remote code execution via symlink following in Plesk's Site Import and Migrator extensions allows network-accessible, low-privilege authenticated users to execute arbitrary code as root on the hosting server. Both webpros:plesk_migrator and webpros:plesk_site_import are affected across all versions per CPE wildcard data, with the flaw rooted in CWE-59 improper link resolution during privileged file operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Plesk user account with at least low-level authenticated access (PR:L per CVSS vector) - entirely unauthenticated external attackers cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects a network-accessible, low-complexity attack requiring only a low-privilege authenticated account and no user interaction - signals pointing to meaningful real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the official Plesk vendor advisory at https://support.plesk.com/hc/en-us/articles/42871001389207-Vulnerability-CVE-2026-65647-in-Plesk-s-Site-Import-and-Migrator-extensions for patched extension versions and upgrade procedures; a patch is available per the vendor advisory, but no specific fixed version number was present in the available intelligence data and cannot be independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all production Plesk servers to identify instances of Site Import and Migrator extensions and determine which are actively in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today