CVE-2026-107246
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 10, 2026
Vendor
unknown
Description
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.