CVE-2026-65647

Received Received - Intake

Improper Symlink Resolution in Plesk Leads to Privilege Escalation

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: HackerOne

Description

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-65647

EUVD

EUVD-2026-66761

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of symbolic links before accessing files in Plesk. A remote authenticated user could exploit this to trick the system into accessing unintended files, potentially leading to arbitrary code execution with root privileges.

Impact Analysis

If exploited, this flaw could allow attackers to gain full control over the server running Plesk, enabling them to install malware, steal data, or disrupt services. Even with authenticated access, the impact is severe due to potential root-level compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Apply the latest security patches from Plesk immediately. Disable symlink resolution if not required. Restrict user permissions to minimize access. Monitor system logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-65647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70