{"id":"CVE-2026-107246","published":"2026-11-10T01:17:12.880","lastModified":"2026-11-10T01:17:12.880","description":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}