File and Path Handling

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.CVE-2026-65647WebPros · CVSS 8.7 · 0.7% likely

   CWE-59

2. An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via…CVE-2026-68492WebPros · CVSS 8.7 · 0.7% likely

   CWE-426

3. Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-68487WebPros · CVSS 9.9 · 0.6% likely

   CWE-36

4. Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.CVE-2026-105476WebPros · CVSS 8.8 · 0.6% likely

   CWE-59

5. An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker w…CVE-2026-67402WebPros · CVSS 9.2 · 0.5% likely

   CWE-552

6. A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS o…CVE-2026-29203WebPros · CVSS 8.8 · 0.5% likelycovered by CyberSIXT

   CWE-61

7. An insufficient check allowed for the overwrite of arbitrary files via a symlink.CVE-2026-68491Webpros · CVSS 9.4 · 0.5% likely

   CWE-59

8. Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.CVE-2026-29201WebPros · CVSS 8.6 · 0.4% likelycovered by CyberSIXT

   CWE-23

9. The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirec…CVE-2026-107246WebPros · CVSS 9.2 · 0.4% likely

   CWE-22

10. Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.CVE-2026-67397WebPros · CVSS 8.5 · 0.2% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.