# CVE-2026-107246: Plesk Site Import path traversal in session handling

Source: https://junglewise.ai/threats/cve-2026-107246-the-plesk-extension-site-import-before-1-13-2-does-not-properly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-107246 · Severity: info · Published 2026-11-10

Plesk's Site Import extension, used to migrate websites into hosting accounts, contains a validation flaw that allows unprivileged users to hijack administrative sessions and execute code with root privileges. An attacker can redirect a privileged backend session into a directory under their control, leading to complete system compromise.

Vendors: [Plesk](https://junglewise.ai/threats/vendors/plesk).

## Quick answers

**Is CVE-2026-107246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107246 being exploited in the wild.

**How severe is CVE-2026-107246?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Plesk Site Import before 1.13.2.

**Is there a fix for CVE-2026-107246?** Yes: fixed in Site Import 1.13.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107246 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107246?** Check whether you run Plesk Site Import at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Site Import 1.13.2

## Technical details

The Site Import extension fails to properly validate domain and session identifiers, enabling a path traversal attack. A non-owner subscription user can manipulate these parameters to redirect a privileged backend session into an attacker-controlled directory, achieving arbitrary code execution as the root user on the Plesk server.

## Affected products

- Plesk Site Import before 1.13.2

## Timeline

- 2026-11-10: disclosed

## References

- [https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension](https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension)