CVE-2026-48614

Full vulnerability record from the local CVENow database.

Description

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

Severity

CRITICAL

CVSS score

9.9 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-06 18:16:46.130000

Last modified

2026-10-25 20:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-48614",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T18:16:46.130",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autorización impropia en la API XML de Plesk permite a un usuario autenticado inyectar directivas de configuración arbitrarias, resultando en escritura de archivos arbitrarios como root y escalada total de privilegios en el servidor subyacente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WebPros",
          "product": "Plesk",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "18.0.78",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T17:38:57.574170Z",
          "id": "CVE-2026-48614",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API",
      "source": "[email protected]"
    }
  ]
}