CVEvulnerability
CVE-2025-66431
7.8 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-12-03
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-61
Description
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
Related
Weakness · CWE (1)
- CWE-61 UNIX Symbolic Link (Symlink) Following weakness
References
- https://docs.plesk.com/release-notes/obsidian/change-log/#plesk-18074 docs.plesk.com
- https://docs.plesk.com/release-notes/obsidian/whats-new/ docs.plesk.com
- https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root support.plesk.com