Critical Plesk Flaw (CVE-2025-66430) Risks Full Server Takeover via LPE and Apache Config Injection

A critical vulnerability in Plesk, tracked as CVE-2025-66430, could allow full server takeover via local privilege escalation and Apache configuration injection, with a CVSS of 9.1. The flaw lies in Plesk for Linux within the Password-Protected Directories feature, enabling users to inject arbitrary data into the server’s Apache configuration.

According to the advisory, this security gap allows Plesk users to execute any commands as the root user, posing a severe risk to shared hosting environments where a single compromised account can affect the entire server and other sites. Plesk has issued emergency micro-updates, with patches for Plesk 18.0.73 and 18.0.74 (versions 18.0.73.5 and 18.0.74.2) and upgrade guidance for 18.0.70–18.0.72, plus updates for older Onyx versions.

Administrators are urged to update installations immediately to mitigate the threat. The article notes that the vulnerability’s critical nature underscores the importance of applying the advisory’s recommended upgrade path to prevent root-level compromise.