Vulnerability CVE-2026-107246 in Plesk’s Site Import extension
CVE-2026-107246 affects Plesk's Site Import extension: versions 1.13.1 and earlier are vulnerable, with the fix shipped in Site Import 1.13.2. Update the extension via the Plesk GUI (Extensions → check for updates) or the command line: plesk bin extension --update site-import.
डिफ़ॉल्ट अपडेट कमांड
plesk installer --select-release-current --update-installedSharedLicense लाइसेंस के तहत इसका अर्थ
The Site Import extension pulls and parses external websites — flaws there are reachable by pointing the importer at a crafted source, giving an authenticated Plesk user a code-execution path on the server.
Situation
A security vulnerability was discovered in Plesk‘s Site Import extension. This security vulnerability has been identified as CVE-2026-107246.
Affected product version
| Product / Component | Affected versions | Patched versions |
|---|---|---|
| Site Import extension | 1.13.1 and earlier | 1.13.2 |
Impact
Arbitrary code execution as the root user is possible. A Plesk user without administrative privileges may be able to run commands on the server, which can compromise the whole server and all subscriptions hosted on it.
Call to action
Update the Site Import extension to version 1.13.2 or later. See How to manage Plesk extensions (install, disable, remove, update) for the update steps.
How to confirm the patched version is installed
Go to Extensions > My Extensions and check the version shown for the Site Import extension. It should be 1.13.2 or later.
Acknowledgement
We would like to thank Ady Elouej for responsibly disclosing this vulnerability and working with us to help protect our customers.
अक्सर पूछे जाने वाले प्रश्न
What is CVE-2026-107246?
Who is affected?
How do I apply the fix?
Is the Site Import extension exposed by default?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें