CVE-2026-107246: Plesk Site Import path traversal in session handling

CVE-2026-107246 · Severity: info · Published 2026-11-10

Plesk's Site Import extension, used to migrate websites into hosting accounts, contains a validation flaw that allows unprivileged users to hijack administrative sessions and execute code with root privileges. An attacker can redirect a privileged backend session into a directory under their control, leading to complete system compromise.

Vendors: Plesk.

Quick answers

Is CVE-2026-107246 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107246 being exploited in the wild.
How severe is CVE-2026-107246?
Informational severity, published 10 November 2026.
Which products and versions are affected?
Plesk Site Import before 1.13.2.
Is there a fix for CVE-2026-107246?
Yes: fixed in Site Import 1.13.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107246 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-107246?
Check whether you run Plesk Site Import at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Site Import 1.13.2

Technical details

The Site Import extension fails to properly validate domain and session identifiers, enabling a path traversal attack. A non-owner subscription user can manipulate these parameters to redirect a privileged backend session into an attacker-controlled directory, achieving arbitrary code execution as the root user on the Plesk server.

Affected products

  • Plesk Site Import before 1.13.2

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.