CVE-2025-66431: WebPros Plesk RCE Vulnerability

CVE-2025-66431 Overview

CVE-2025-66431 affects WebPros Plesk on Linux, allowing authenticated users to execute arbitrary code as root through the domain creation mechanism. The vulnerability exists in Plesk versions before 18.0.73.5 and in the 18.0.74 branch before 18.0.74.2. Exploitation requires an attacker to hold the "Create and manage sites" permission with both "Domains management" and "Subdomains management" privileges. The flaw is categorized under [CWE-61] (UNIX Symbolic Link Following), indicating that the domain creation process fails to safely resolve filesystem links. Successful exploitation results in privilege escalation from a low-privileged Plesk user to full root control of the underlying host.

Critical Impact
Authenticated Plesk users with domain management permissions can escalate to root on the host operating system, compromising all hosted sites and system data.

Affected Products

WebPros Plesk for Linux versions before 18.0.73.5
WebPros Plesk for Linux 18.0.74 before 18.0.74.2
Plesk Obsidian deployments meeting the above version criteria

Discovery Timeline

2025-12-03 - CVE-2025-66431 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66431

Vulnerability Analysis

The vulnerability resides in the Plesk domain creation workflow on Linux hosts. When a Plesk user creates a domain or subdomain, the panel performs filesystem operations as root to provision directories, configuration files, and virtual host structures. The underlying process does not safely handle symbolic links within paths it operates on. An authenticated attacker with domain management rights can plant a symbolic link that redirects a privileged file operation to an attacker-chosen location. This turns a routine provisioning step into an arbitrary write executed with root privileges, which the attacker then leverages for full code execution on the server.

Root Cause

The root cause is a UNIX symbolic link following weakness classified as [CWE-61]. The domain creation code trusts filesystem paths within user-controllable areas without verifying that intermediate path components are not symlinks. Because the operation runs with elevated privileges, following an attacker-planted symlink allows writes outside the intended domain directory. The design flaw combines privileged execution with unsafe path resolution, breaking the isolation Plesk expects between panel users and the host operating system.

Attack Vector

Exploitation requires local, authenticated access to the Plesk panel with specific permissions: "Create and manage sites" along with "Domains management" and "Subdomains management." An attacker meeting these prerequisites triggers domain or subdomain creation while a symlink is staged in a location touched by the privileged provisioning routine. The privileged process follows the symlink and writes to a sensitive target, such as a system configuration file or an executable location. The attacker then invokes the modified target to obtain code execution as root. No user interaction from an administrator is required beyond the attacker's own actions.

No public proof-of-concept code has been verified for this issue. See the Plesk CVE-2025-66431 Security Article for vendor technical details.

Detection Methods for CVE-2025-66431

Indicators of Compromise

Unexpected symbolic links inside directories under /var/www/vhosts/ created shortly before a domain or subdomain provisioning event.
Modification timestamps on system files such as /etc/passwd, /etc/shadow, /etc/cron.d/, or shell profile files that correlate with Plesk domain creation actions.
New or altered SUID binaries appearing after a Plesk user with domain management rights logs in.
Plesk panel audit entries showing repeated failed or unusual domain creation attempts by a non-administrative user.

Detection Strategies

Correlate Plesk panel activity logs with filesystem change events to flag domain creation actions that coincide with writes outside the target vhost directory.
Monitor privileged process activity from Plesk services (psa, sw-engine) that traverse symbolic links leading outside /var/www/vhosts/.
Alert on any Plesk-initiated writes to system paths such as /etc/, /root/, or /usr/local/bin/.

Monitoring Recommendations

Enable Linux audit rules (auditd) on directories used by Plesk to capture symlink, symlinkat, and openat calls made by privileged Plesk processes.
Forward Plesk panel logs and system audit logs to a centralized SIEM for correlation between user actions and privileged filesystem changes.
Review the list of Plesk users granted "Domains management" and "Subdomains management" permissions and alert on any additions.

How to Mitigate CVE-2025-66431

Immediate Actions Required

Upgrade Plesk for Linux to version 18.0.73.5 or to 18.0.74.2 or later without delay.
Audit all Plesk users holding "Create and manage sites" with "Domains management" and "Subdomains management" permissions and remove unnecessary grants.
Reset credentials for any Plesk user account that has held domain management permissions on an unpatched host.
Inspect hosts for anomalous symlinks and unauthorized changes to system files before returning them to normal operation.

Patch Information

WebPros has released fixed builds in Plesk Obsidian 18.0.73.5 and 18.0.74.2. Upgrade details are documented in the Plesk Release Notes Changelog and the Plesk What's New Overview. Administrators using automatic updates should confirm that their installation has moved to a fixed version by checking the panel's About page or running the Plesk updater manually.

Workarounds

Restrict the "Create and manage sites" role by removing "Domains management" and "Subdomains management" from untrusted users until patches are applied.
Limit shell access on the Plesk host and enforce strict file system permissions on directories writable by Plesk users.
Increase monitoring on the Plesk server and treat any anomalous domain creation activity as a high-priority alert until the upgrade is complete.

bash

# Configuration example: verify Plesk version and trigger update on Linux
plesk version
plesk installer --select-release-current --upgrade-installed-components
plesk version