+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
PleskSecurityHostingCVE

CVE-2026-107246: Plesk Site Import Path Traversal - Tenant to Root, Floor 1.13.2

By ServerGurus Team12 November 20268 min read
CVE-2026-107246: Plesk Site Import Path Traversal - Tenant to Root, Floor 1.13.2

CVE-2026-107246 is a path traversal in Plesk's Site Import extension before 1.13.2. CNA: HackerOne (support@hackerone.com). CWE CWE-22. NVD published 2026-11-10T01:17:12.880, vulnStatus Received, lastModified the same timestamp. CVE.org datePublished 2026-11-10T00:33:12.589Z, reserved 2026-10-07T15:00:00.550Z. Finder credit on the CVE record and on Plesk's advisory: Ady Elouej.[1][2][3]

HackerOne CVSS 4.0 9.2 CRITICAL AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (NVD Secondary; no Primary metric in the JSON we pulled). GHSA GHSA-vr33-8mcv-hqqf, type unreviewed, same 9.2, published 2026-11-10T03:30:25Z.[1][4]

Vendor floor: Site Import 1.13.2, changelog dated 4 November 2026. Plesk help-center article created 2026-11-06T16:10:01Z, last updated 2026-11-09T09:39:26Z. Affected, vendor table: 1.13.1 and earlier. Patched: 1.13.2. Impact, vendor verbatim: Arbitrary code execution as the root user is possible. A Plesk user without administrative privileges may be able to run commands on the server, which can compromise the whole server and all subscriptions hosted on it.[2][5]

CISA KEV catalog 2026.11.10 (count 1779, dateReleased 2026-11-10T19:03:29.8375Z) does not list this CVE. Not a federal 12 Nov clock. Yesterday's Contact Form 7 post and the musl OpenSSH KEV are different queues.[6]

This is not CVE-2026-87898. That was Site Import 1.12.2 (23 September 2026): unquoted database name → OS command injection (CWE-78). This ID is CWE-22, floor 1.13.2, NVD text: domain and session identifiers are not validated, a non-owner subscription user redirects a privileged backend session into a directory they control. Pinning 1.12.2 does not close this one.[7][1]

What it is

Site Import is the customer-facing "bring the site from the other host" extension. It writes files and data under subscription directories, which means identifiers on that path are tenant-shaped input.

NVD / CVE.org, verbatim class: the extension does not properly validate domain and session identifiers, allowing path traversal. That lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.[1][3]

We are not publishing identifier values, endpoints, or a request sequence. The vendor changelog for 1.13.2 is one line: This update addresses a critical security issue. We strongly recommend that you apply it as soon as possible. (CVE-2026-107246). That is enough for a host to know the floor. Do not treat this paragraph as a lab result from us.[5]

1.13.1 is not a safe pin. Site Import 1.13.1 (2 November 2026) only restored Windows catalog install/update after Could not open temp file python_migrator.zip (PMT-5718). 1.13.0 (26 October 2026) changed package signing keys and listed generic "Security improvements" - it is still < 1.13.2. Anyone who froze on either build is in range.[5]

How serious is it?

On paper (HackerOne CVSS 4.0): network, low complexity, attack requirements present (AT:P), privileges required NONE on the vector, high C/I/A on the vulnerable system, subsequent-system impact none - 9.2 CRITICAL.[1]

On the description: the actor is a non-owner subscription user. That is an authenticated tenant, not a random unauthenticated GET. PR:N on the vector and "subscription user" in the text do not agree. Treat the description as the access model; treat AT:P as the CNA flag that something besides "the port is open" has to be true. We did not reconcile the vector for them.[1][2]

KEV / exploitation: not in catalog 2026.11.10. GHSA epss.percentage 0.00405 (percentile 0.35067) as of the API object we pulled - that is a model score, not a CISA exploitation bar. Do not upgrade a third-party write-up into a due date.[6][4]

NVD enrichment: vulnStatus Received. No NVD-assigned 3.x. No CISA-ADP row in the JSON. The 9.2 is the CNA number.[1]

Who is affected

Product / setup This bug? Floor / note
Site Import 1.13.1 and earlier Yes, vendor table Floor 1.13.2.[2]
Site Import 1.13.2+ Vendor: patched Confirm fullVersion, do not trust "Update available" greyed out.[2]
Site Import 1.12.2 (CVE-2026-87898 pin) Still this CVE 1.12.2 closed the DB-name injection. It is < 1.13.2.[7][5]
Site Import not installed Out of this CVE Inventory first. Do not skip the rest of this week's Plesk queue.[2]
Plesk for Windows Not excluded Advisory has no Linux-only line this time. 1.13.1 was a Windows catalog-install fix. Treat Windows as in range until WebPros says otherwise.[2][5]
Plesk Obsidian 18.0.82 Update 2 / 18.0.81 Update 7 (3 Nov) Different queue Changelog: separate Linux "critical security issue," regenerates vhost configs. No CVE ID on that line. Do not assign 107246 to the panel build.[5]

What to do now

  1. Inventory the extension, not the panel version.
plesk bin extension --list | grep -i import
plesk bin extension --get-xml-info site-import

--list is the documented inventory. --get-xml-info is the version check. You want fullVersion 1.13.2 or later. If Site Import is not installed, this CVE does not apply to that box - still take 18.0.82 U2 / 18.0.81 U7 this week; that is a different critical.[2][5]

UI path from the advisory: Extensions → My Extensions, Site Import 1.13.2+.[2]

  1. Patch. Do not wait for tonight's extension cron.
plesk bin extension --upgrade site-import
# if the catalog is stale, force it:
plesk bin extension --install site-import
plesk bin extension --get-xml-info site-import   # must show 1.13.2+

Or: Extensions → Update → Check Now, then update Site Import. Plesk's "How to manage Plesk extensions" article is the vendor procedure.[8][2]

  1. If you cannot patch this hour: disable or uninstall Site Import on plans that do not need customer-driven imports. That is a compensating control, not a substitute for 1.13.2. The advisory does not publish an interim workaround.[2]

  2. Fleet one-liner.

for h in $(cat plesk-hosts.txt); do
  ssh root@$h 'echo -n "$HOSTNAME "; plesk version | head -1; plesk bin extension --get-xml-info site-import 2>/dev/null | tr -d "\n"; echo'
done

Anything showing Site Import ≤ 1.13.1 (including a proud 1.12.2 pin) is still a customer-to-root box for this ID.

  1. Same-week panel builds, different bug. Changelog 3 November 2026: Plesk Obsidian 18.0.82 Update 2 and 18.0.81 Update 7 each say Linux This update addresses a critical security issue and regenerate every domain's web-server config. Custom vhost templates need a review after that update. We have no CVE for that line in the changelog extract. Take the build. Do not file it under 107246.[5]

Unsupported versions

The CNA range is 0 ≤ version < 1.13.2 (semver). There is no "Site Import 1.6 is fine" carve-out in the NVD affected object. Vendor table is 1.13.1 and earlier. If a box is stuck on an extension catalog that cannot see 1.13.2, uninstall Site Import or get the catalog talking - do not invent a lower bound the CNA did not publish.[1][2]

Compromise signs

Neither Plesk nor NVD publishes IOCs for this ID. Operator checks, not signatures:

  • Site Import version still ≤ 1.13.1 while customer imports were allowed after 4 Nov 2026.
  • Unexpected files or session-shaped directories under subscription trees you did not create.
  • New root cron, unexpected authorized_keys, setuid binaries, outbound shells from Plesk PHP/Python around import jobs.

Absence of those files is not proof you were never hit. Patch first. The advisory does not claim exploitation in the wild.[2]

FAQ

Is this September's Site Import root? No. CVE-2026-87898 is CWE-78, floor 1.12.2, database name into a root command. CVE-2026-107246 is CWE-22, floor 1.13.2, domain/session identifiers. Different finder (Ady Elouej vs the September report).[7][3]

Is this in CISA KEV? No. Catalog 2026.11.10, 1779 entries. No 12 Nov federal due date for this ID.[6]

Does PR:N mean unauthenticated Internet RCE? The vector says none. The description says non-owner subscription user. We are not flattening that to "anyone on 8443." Assume a tenant (or a stolen tenant login) until WebPros publishes a tighter privilege list.[1][2]

Windows too? This advisory does not repeat the Linux-only sentence from CVE-2026-87898. 1.13.1 exists because Windows catalog install was broken. Patch Windows Site Import to 1.13.2 as well, or remove the extension.[2][5]

Will plesk bin extension --upgrade site-import regenerate vhosts? Vendor does not say that for 1.13.2. Vhost regeneration is called out on 18.0.82 U2 / 18.0.81 U7, a different 3 Nov critical. Read that note before you take the panel build on a box with custom templates.[5]

Is 1.13.0's "Security improvements" this CVE? Changelog does not name 107246 on 1.13.0. Floor is 1.13.2. Do not stop at 1.13.0.[5]

Honesty

  • We did not run Site Import against a lab or customer box. No path, identifier, or session was supplied by us.
  • CVSS 9.2 is HackerOne Secondary on NVD. NVD status Received. No CISA-ADP metric in the JSON.[1]
  • PR:N vs "non-owner subscription user" is unresolved in the primary sources. We flagged it; we did not pick a side.[1][2]
  • Not in KEV (catalogVersion 2026.11.10, 1779 entries). No CISA exploitation claim for this ID.[6]
  • GHSA is unreviewed. EPSS 0.404% is a score, not evidence of scanning.[4]
  • Conversion from "redirected privileged session" to root execution is vendor/CNA stated, not a mechanism we verified. No public PoC in the advisory or CVE record.[1][2]
  • 18.0.82 U2 / 18.0.81 U7 critical is changelog-only, no CVE in the extract we saved. Do not merge it into 107246.[5]
  • Windows-affected is our reading of a missing exclusion, not a vendor "Windows is affected" sentence.

Sources

  1. NVD CVE-2026-107246 - published 2026-11-10T01:17:12.880; CNA HackerOne; status Received; CWE-22; CVSS 4.0 9.2 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; affected Site Import 0 < 1.13.2
  2. Plesk - Vulnerability CVE-2026-107246 in Plesk's Site Import extension - Zendesk JSON pulled 2026-11-12; created 2026-11-06T16:10:01Z; updated 2026-11-09T09:39:26Z; affected 1.13.1 and earlier; patched 1.13.2; credit Ady Elouej
  3. CVE Program CVE-2026-107246 - cveawg JSON; datePublished 2026-11-10T00:33:12.589Z; dateReserved 2026-10-07T15:00:00.550Z; finder Ady Elouej
  4. GHSA-vr33-8mcv-hqqf - published 2026-11-10T03:30:25Z; unreviewed; CVSS 4.0 9.2; epss 0.00405
  5. Plesk Obsidian changelog - Site Import 1.13.2 (4 November 2026, CVE-2026-107246); 1.13.1 (2 November 2026, PMT-5718); 1.13.0 (26 October 2026); 18.0.82 Update 2 / 18.0.81 Update 7 (3 November 2026)
  6. CISA KEV JSON - catalogVersion 2026.11.10; count 1779; dateReleased 2026-11-10T19:03:29.8375Z; CVE-2026-107246 not present
  7. CVE-2026-87898, this blog 28 Sep 2026 - Site Import 1.12.2, CWE-78, different bug
  8. Plesk - How to manage Plesk extensions - vendor update steps linked from the advisory

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales