A high-severity path traversal vulnerability in Plesk allows authenticated local users to execute arbitrary code as root, posing a critical risk to server integrity.

The software contains a path traversal flaw (CWE-22) that allows a local, authenticated attacker to manipulate file paths. This vulnerability enables the escalation of privileges, ultimately permitting the execution of arbitrary code with root-level system access.

Successful exploitation of this vulnerability results in a total compromise of the affected Plesk server. Because the attacker can execute code as root, they can bypass all security controls, access sensitive configuration files, modify website content, or install persistent backdoors. With a CVSS score of 8.5, this high-severity flaw demands immediate attention to prevent unauthorized administrative control over the hosting environment.

Immediate Action: Review the official Plesk security advisory and apply the latest security updates provided by WebPros to patch the affected versions.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access system directories or unusual process execution patterns initiated by lower-privileged user accounts.

Compensating Controls: Ensure that local user accounts are restricted by using filesystem permissions and monitoring tools to detect unauthorized file access attempts outside of intended user directories.

Public Exploit Available: No

Given the potential for full root compromise, administrators should prioritize patching their Plesk instances immediately. Until the patch is applied, ensure that local user access to the server is strictly audited and limited to trusted personnel, as the primary vector requires an existing authenticated local session.