A non-owner subscription user may redirect a privileged backend session into a directory that user controls.Successful exploitation may result in remote code execution as root. NVD records a CVSS 4.0 score of 9.2 Critical from the HackerOne CNA.
What it allows
How Does CVE-2026-107246 Work?
The extension does not properly validate domain and session identifiers. This weakness allows path traversal outside the directory boundary the application expects.
A non-owner subscription user may point a privileged backend session toward a directory under that user's control. The attacker may then execute arbitrary code with root privileges.
The prerequisite matters because this is not an unauthenticated flaw. The attacker must already hold access as a low-privileged subscription user before attempting privilege escalation.
Who is affected
Which Versions Does CVE-2026-107246 Affect?
The CVE record identifies Plesk Site Import releases before 1.13.2 as vulnerable. Administrators should update the extension to version 1.13.2 or later.
Teams should include extension versions in their vulnerability management inventory. They should prioritize internet-facing Plesk systems where untrusted users can receive subscription access.
What to do
-
Update Site Import
Install Plesk Site Import 1.13.2 or a later available release. Verify the extension version after maintenance on every managed Plesk system.
-
Review subscription access
Brandefense recommends identifying non-owner subscription users and validating that each account still needs access. Remove unnecessary accounts and permissions through approved administrative workflows.
-
Prioritize exposed systems
Prioritize systems reachable from untrusted networks, especially when third parties receive subscription access. Restrict administrative exposure while the update is being deployed.
-
Review privileged activity
Brandefense recommends reviewing Plesk, authentication, process, and operating-system telemetry for unexpected privileged activity. Preserve evidence and follow the incident response plan when anomalies appear.
Frequently Asked Questions
What is CVE-2026-107246?
It is a path traversal vulnerability in the Plesk Site Import extension. It may let a non-owner subscription user execute arbitrary code as root.
Is CVE-2026-107246 unauthenticated?
No. The CVE record states that exploitation requires access as a non-owner subscription user.
Which Plesk Site Import versions are affected?
The CVE record identifies versions before 1.13.2 as vulnerable. Administrators should install version 1.13.2 or later.
How severe is CVE-2026-107246?
NVD records a HackerOne CNA CVSS 4.0 score of 9.2 Critical. The record does not provide a CVSS 3.1 score.
Sources
- GitHub Advisory GHSA-vr33-8mcv-hqqfGitHub
- NVD: CVE-2026-107246NIST NVD
