CVE-2026-68492

Awaiting Analysis Awaiting Analysis - Queue

Untrusted Search Path in Plesk RESTful API Extension

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: HackerOne

Description

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-68492

EUVD

EUVD-2026-85621

Affected Vendors & Products

Vendor	Product	Version / Range
plesk	plesk	to 18.0.80.8 (exc)
plesk	plesk	From 18.0.81 (inc) to 18.0.81.1 (exc)
plesk	plesk_restful_api	From 2.4.2 (inc) to 2.4.7 (exc)
plesk	plesk	to 18.0.81.1 (exc)
plesk	plesk_restful_api_extension	to 2.4.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

CVE-2026-68492 is an untrusted search path vulnerability in Plesk for Linux. It allows remote authenticated users to execute arbitrary code with root privileges through the Plesk RESTful API extension. The flaw exists in specific versions of Plesk and the extension.

Detection Guidance

Check Plesk version with 'plesk version' command. Verify RESTful API extension version via Plesk interface or API. Look for unauthorized API calls in logs.

Impact Analysis

This vulnerability allows attackers with authenticated access to gain root privileges on the server. This could lead to full system compromise, data theft, unauthorized modifications, or disruption of services. Servers running vulnerable versions are at risk even if the extension was not manually installed.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR and HIPAA. It may result in legal penalties, loss of certification, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Update Plesk to 18.0.80.8, 18.0.81.0, or later. Update RESTful API extension to 2.4.7 or later. Remove or disable the extension if not needed.

Hi! I’m here to help you understand CVE-2026-68492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70