Plesk Site Import
Monthly
Remote code execution via symlink following in Plesk's Site Import and Migrator extensions allows network-accessible, low-privilege authenticated users to execute arbitrary code as root on the hosting server. Both webpros:plesk_migrator and webpros:plesk_site_import are affected across all versions per CPE wildcard data, with the flaw rooted in CWE-59 improper link resolution during privileged file operations. No public exploit or active exploitation is confirmed at time of analysis, but the low-complexity, network-accessible attack path and root-level impact make this a high-priority remediation target for Plesk hosting environments.
Remote code execution via symlink following in Plesk's Site Import and Migrator extensions allows network-accessible, low-privilege authenticated users to execute arbitrary code as root on the hosting server. Both webpros:plesk_migrator and webpros:plesk_site_import are affected across all versions per CPE wildcard data, with the flaw rooted in CWE-59 improper link resolution during privileged file operations. No public exploit or active exploitation is confirmed at time of analysis, but the low-complexity, network-accessible attack path and root-level impact make this a high-priority remediation target for Plesk hosting environments.