Vulnerability CVE-2026-107246 in Plesk’s Site Import extension
CVE-2026-107246 affects Plesk's Site Import extension: versions 1.13.1 and earlier are vulnerable, with the fix shipped in Site Import 1.13.2. Update the extension via the Plesk GUI (Extensions → check for updates) or the command line: plesk bin extension --update site-import.
Команда обновления по умолчанию
plesk installer --select-release-current --update-installedЧто это значит по лицензии SharedLicense
The Site Import extension pulls and parses external websites — flaws there are reachable by pointing the importer at a crafted source, giving an authenticated Plesk user a code-execution path on the server.
Situation
A security vulnerability was discovered in Plesk‘s Site Import extension. This security vulnerability has been identified as CVE-2026-107246.
Affected product version
| Product / Component | Affected versions | Patched versions |
|---|---|---|
| Site Import extension | 1.13.1 and earlier | 1.13.2 |
Impact
Arbitrary code execution as the root user is possible. A Plesk user without administrative privileges may be able to run commands on the server, which can compromise the whole server and all subscriptions hosted on it.
Call to action
Update the Site Import extension to version 1.13.2 or later. See How to manage Plesk extensions (install, disable, remove, update) for the update steps.
How to confirm the patched version is installed
Go to Extensions > My Extensions and check the version shown for the Site Import extension. It should be 1.13.2 or later.
Acknowledgement
We would like to thank Ady Elouej for responsibly disclosing this vulnerability and working with us to help protect our customers.
Часто задаваемые вопросы
What is CVE-2026-107246?
Who is affected?
How do I apply the fix?
Is the Site Import extension exposed by default?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему