Medium 2026-06-30

Security Advisory: Plesk Backup Manager Path Traversal

Plesk AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 8 CloudLinux 9 Debian 11 Debian 12 Ubuntu 20.04 Ubuntu 22.04

The Plesk Backup Manager fails to sanitize archive paths, allowing a local attacker to read arbitrary files on the server via a crafted backup manifest.

Affected Versions

Plesk Obsidian 18.0.58 and earlier

Patched Version

Plesk Obsidian 18.0.60

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

plesk installer update --select-product-id plesk
plesk sbin packagemng --update

AlmaLinux 8 / CloudLinux 8

plesk installer update --select-product-id plesk

CentOS 7 / CloudLinux 7

plesk installer update --select-product-id plesk

Ubuntu 22.04 / Debian 12

apt update
plesk installer update --select-product-id plesk

Ubuntu 20.04 / Debian 11

apt update
plesk installer update --select-product-id plesk

More Information

Security Advisories

Latest Advisories

ConfigServer Security & Firewall (CSF) 16.30-1 — cPanel & WHM Update

2026-08-07

Sitejet Builder 4.12.0-1 — cPanel & WHM Update

2026-08-07

cPanel & WHM version 138

2026-08-07

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System