Medium 2026-06-30

Security Advisory: Plesk Backup Manager Path Traversal

Plesk AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Debian 11 Debian 12 Ubuntu 20.04 Ubuntu 22.04

The Plesk Backup Manager fails to sanitize archive paths, allowing a local attacker to read arbitrary files on the server via a crafted backup manifest.

Affected Versions

Plesk Obsidian 18.0.58 and earlier

Patched Version

Plesk Obsidian 18.0.60

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

plesk installer update --select-product-id plesk
plesk sbin packagemng --update

AlmaLinux 8 / CloudLinux 8

plesk installer update --select-product-id plesk

CentOS 7 / CloudLinux 7

plesk installer update --select-product-id plesk

Ubuntu 22.04 / Debian 12

apt update
plesk installer update --select-product-id plesk

Ubuntu 20.04 / Debian 11

apt update
plesk installer update --select-product-id plesk

More Information

Security Advisories

Latest Advisories

Security Advisory: cPanel / CSF Plugin

2026-08-06

Security Advisory: cPanel Email Filters RCE

2026-08-06

Security Advisory: CloudLinux $HTTP_HOST Environment Injection

2026-08-06

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System