CVE-2026-107246

Vendor

WebPros

Product

Plesk extension "Site Import"

CVSS v4.0

9.2 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-22

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 38
   CVE NVD 1h ago

   The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal.

   The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory…

   CVSS 9.2 CVE-2026-107246 WebPros