Security Advisory: Plesk Backup Manager Path Traversal
A path traversal vulnerability in Plesk's Backup Manager is fixed in this security release: crafted input during backup or restore handling could reach locations outside the intended directory. Update Plesk through the standard micro-update channel.
Затронутые версии
Plesk Obsidian 18.0.58 and earlier
Исправленная версия
Plesk Obsidian 18.0.60
Команда обновления по умолчанию
yum update -yКоманды исправления
AlmaLinux 9 / CloudLinux 9
plesk installer update --select-product-id plesk
plesk sbin packagemng --updateAlmaLinux 8 / CloudLinux 8
plesk installer update --select-product-id pleskCentOS 7 / CloudLinux 7
plesk installer update --select-product-id pleskUbuntu 22.04 / Debian 12
apt update
plesk installer update --select-product-id pleskUbuntu 20.04 / Debian 11
apt update
plesk installer update --select-product-id pleskЧто это значит по лицензии SharedLicense
Your SharedLicense license itself is not affected — this is a change in Plesk software, not in licensing. Apply it on every affected server: plesk installer --select-release-current --update-installed. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
Plesk‘s Backup Manager handles export, storage and restore of server backups. A path traversal flaw meant crafted input could make backup operations touch files outside the directories they are confined to — the classic escape that turns a convenience feature into a read/write primitive.
Who is affected
Plesk servers whose users can create or restore backups — on most hosting setups that includes customer-facing roles, so exposure is common rather than exotic.
How to apply the fix
- Apply the micro-update:
plesk installer --select-release-current --update-installed - Review recent backup tasks and their storage paths for anything unexpected.
For SharedLicense customers
The license is not involved — this is a Plesk software fix. Backups and licenses both keep working through the update.
Часто задаваемые вопросы
What does the Backup Manager flaw allow?
Do I need to change my backup schedule?
How is the fix delivered?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему