CVE-2026-65646

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation via Local File Disclosure in Plesk

Publication date: 2026-08-26

Last updated on: 2026-09-11

Assigner: HackerOne

Description

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-11

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-65646

EUVD

EUVD-2026-66764

Affected Vendors & Products

Vendor	Product	Version / Range
plesk	plesk	to 18.0.79.8 (exc)
plesk	plesk	From 18.0.79.8 (inc)
plesk	plesk	From 18.0.80 (inc)
plesk	plesk	From 18.0.80.3 (inc)
plesk	plesk	From 18.0.80.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Plesk allows remote authenticated users to bypass security controls and access arbitrary local files on the server. It also enables privilege escalation, meaning attackers could gain higher-level access than intended.

Detection Guidance

This vulnerability involves improper neutralization in Plesk allowing file disclosure and privilege escalation. Detection requires checking Plesk configurations for improper input handling and file access controls. Review Plesk logs for unusual file access patterns or privilege changes. Ensure Plesk is updated to the latest version to mitigate risks.

Impact Analysis

If exploited, this flaw could let attackers read sensitive files, steal data, or take full control of the server. This risks data breaches, system compromise, and potential disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Plesk to the latest patched version immediately to address the improper neutralization issue. Disable unnecessary user privileges and restrict file access permissions. Monitor system logs for suspicious activity related to file disclosure or privilege escalation attempts.

Hi! I’m here to help you understand CVE-2026-65646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70