Back to Security Advisories

Security Advisory: Plesk Backup Manager Path Traversal

A path traversal vulnerability in Plesk's Backup Manager is fixed in this security release: crafted input during backup or restore handling could reach locations outside the intended directory. Update Plesk through the standard micro-update channel.

Medium
Plesk AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Debian 11 Debian 12 Ubuntu 20.04 Ubuntu 22.04

Affected Versions

Plesk Obsidian 18.0.58 and earlier

Patched Version

Plesk Obsidian 18.0.60

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

plesk installer update --select-product-id plesk
plesk sbin packagemng --update

AlmaLinux 8 / CloudLinux 8

plesk installer update --select-product-id plesk

CentOS 7 / CloudLinux 7

plesk installer update --select-product-id plesk

Ubuntu 22.04 / Debian 12

apt update
plesk installer update --select-product-id plesk

Ubuntu 20.04 / Debian 11

apt update
plesk installer update --select-product-id plesk

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in Plesk software, not in licensing. Apply it on every affected server: plesk installer --select-release-current --update-installed. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

Plesk‘s Backup Manager handles export, storage and restore of server backups. A path traversal flaw meant crafted input could make backup operations touch files outside the directories they are confined to — the classic escape that turns a convenience feature into a read/write primitive.

Who is affected

Plesk servers whose users can create or restore backups — on most hosting setups that includes customer-facing roles, so exposure is common rather than exotic.

How to apply the fix

  • Apply the micro-update: plesk installer --select-release-current --update-installed
  • Review recent backup tasks and their storage paths for anything unexpected.

For SharedLicense customers

The license is not involved — this is a Plesk software fix. Backups and licenses both keep working through the update.

Frequently Asked Questions

What does the Backup Manager flaw allow?
Path traversal — crafted backup or restore input reaching files outside the intended directory.
Do I need to change my backup schedule?
No — patch the server; existing backup plans keep working unchanged.
How is the fix delivered?
Through Plesk micro-updates: plesk installer --select-release-current --update-installed.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System