# CVE-2026-68487: Plesk Backup Manager path traversal allows arbitrary file write

Source: https://junglewise.ai/threats/cve-2026-68487-plesk-backup-manager-path-traversal-allows-arbitrary-file-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-68487 · Severity: critical · CVSS 9.9 · Published 2026-09-10

Plesk's Backup Manager, a critical utility for backing up and restoring hosting environments, contains a path traversal vulnerability that allows authenticated customers to write arbitrary files to the system with root privileges. An attacker with customer-level access could exploit this during backup restore operations to gain complete control of the hosting server, compromising all hosted customer data and services.

Vendors: [Plesk](https://junglewise.ai/threats/vendors/plesk).

## Quick answers

**Is CVE-2026-68487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68487 being exploited in the wild.

**How severe is CVE-2026-68487?** Critical severity, with a CVSS score of 9.9, published 10 September 2026.

**Which products and versions are affected?** Plesk Backup Manager.

**Is there a fix for CVE-2026-68487?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-68487 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-68487?** Check whether you run Plesk Backup Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in Plesk's Backup Manager that arises from insufficient validation of backup file paths during restore operations. An authenticated customer can craft malicious backup archives containing specially crafted file paths (e.g., containing "../" sequences) that bypass directory restrictions and write files to arbitrary locations on the filesystem. Because the Backup Manager process runs with root privileges, the attacker can overwrite system files, install backdoors, or modify configuration files. The vulnerability requires valid customer credentials and interaction with the backup restore functionality, but no other privileges are needed. Patches are available from Plesk.

## Affected products

- Plesk Backup Manager

## Timeline

- 2026-09-10: disclosed

## References

- [https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal](https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal)