Security Advisory: Plesk Backup Manager Path Traversal

The Plesk Backup Manager fails to sanitize archive paths, allowing a local attacker to read arbitrary files on the server via a crafted backup manifest.

Medium 2026-06-30

Plesk AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Debian 11 Debian 12 Ubuntu 20.04 Ubuntu 22.04

Affected Versions

Plesk Obsidian 18.0.58 and earlier

Patched Version

Plesk Obsidian 18.0.60

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

plesk installer update --select-product-id plesk
plesk sbin packagemng --update

AlmaLinux 8 / CloudLinux 8

plesk installer update --select-product-id plesk

CentOS 7 / CloudLinux 7

plesk installer update --select-product-id plesk

Ubuntu 22.04 / Debian 12

apt update
plesk installer update --select-product-id plesk

Ubuntu 20.04 / Debian 11

apt update
plesk installer update --select-product-id plesk

References

Vendor Advisory

Security Advisories

Related Advisories

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Security: CVE-2026-41940 – cPanel & WHM / WP2 Security Update 04/28/2026

2026-09-08

Security: CSF Security Release – September 3rd, 2026

2026-09-08

Check your system for vulnerabilities

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

Check Your System