CVE-2026-65647 Overview
CVE-2026-65647 is a symlink-following vulnerability in Plesk's Site Import and Migrator extensions. The flaw allows remote authenticated users to execute arbitrary code as root by abusing improper symbolic link resolution before file access. The weakness is classified under CWE-59: Improper Link Resolution Before File Access.
An attacker with valid Plesk credentials can craft symbolic links that redirect privileged file operations to attacker-controlled paths. Because the vulnerable code path executes with root privileges, successful exploitation results in full server compromise.
Critical Impact
Authenticated Plesk users can escalate to root on the underlying host, gaining complete control over the server, hosted sites, and stored customer data.
Affected Products
- Plesk Site Import extension
- Plesk Migrator extension
- Plesk servers where either extension is installed and enabled
Discovery Timeline
- 2026-08-26 - CVE-2026-65647 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-65647
Vulnerability Analysis
The vulnerability resides in file-handling logic within the Site Import and Migrator extensions. Both extensions perform file operations on paths supplied or influenced by an authenticated user. The code accesses these paths without safely resolving symbolic links before privileged operations occur.
Because the affected routines run with elevated privileges, the process follows symlinks that point outside the intended working directories. An attacker can direct writes, reads, or executions against arbitrary files owned by root. This turns a routine migration or import feature into a local-to-remote privilege escalation primitive triggered over the network by any authenticated user.
Root Cause
The root cause is the classic [CWE-59] pattern: the code checks or opens a file path without using symlink-safe primitives such as O_NOFOLLOW, openat2 with RESOLVE_NO_SYMLINKS, or explicit lstat validation. An attacker plants a symlink between the check and the privileged operation, or supplies a path already containing a symlink component. The kernel follows the link during the privileged operation, applying root permissions to attacker-chosen targets.
Attack Vector
Exploitation requires network access to the Plesk control panel and valid low-privilege credentials. The attacker interacts with the Site Import or Migrator workflow, supplying an input that causes the extension to perform file operations on a path they control. By placing a symbolic link in that path, the attacker redirects the privileged operation to a sensitive location such as /etc/cron.d/, /root/.ssh/authorized_keys, or a system binary. Writing attacker-controlled content to any of these locations yields arbitrary code execution as root.
No verified public proof-of-concept code is available. Technical details are described in the Plesk Security Advisory CVE-2026-65647.
Detection Methods for CVE-2026-65647
Indicators of Compromise
- Unexpected symbolic links inside directories used by the Site Import or Migrator extensions, particularly links pointing outside the tenant's home directory.
- New or modified files in privileged locations such as /etc/cron.d/, /etc/sudoers.d/, /root/.ssh/, or system service unit paths, timestamped near Plesk import or migration activity.
- Plesk audit log entries showing Site Import or Migrator jobs launched by non-administrative users followed by shell activity under root.
Detection Strategies
- Monitor Plesk task logs (/var/log/plesk/panel.log and extension-specific logs) for import or migration jobs that reference paths containing symlinks or paths outside the panel's expected working directories.
- Alert on root-owned process creation whose parent is a Plesk PHP or Python helper associated with the Site Import or Migrator extensions.
- Track file integrity on sensitive system paths and flag any writes attributable to Plesk service accounts.
Monitoring Recommendations
- Enable auditd rules on symlink creation (symlink, symlinkat) within Plesk user home directories and correlate with subsequent privileged file access.
- Forward Plesk panel logs and Linux audit events to a centralized analytics platform for correlation across authentication, extension activity, and privileged file operations.
- Review authenticated Plesk user activity for unusual use of Site Import or Migrator features, especially from accounts that do not normally perform migrations.
How to Mitigate CVE-2026-65647
Immediate Actions Required
- Apply the fixed versions of the Site Import and Migrator extensions as published in the Plesk Security Advisory CVE-2026-65647.
- Audit all Plesk user accounts and disable or reset credentials for accounts that are inactive, shared, or no longer required.
- Inspect servers for signs of prior exploitation, focusing on unauthorized changes in privileged system paths and unexpected root cron jobs or SSH keys.
Patch Information
Plesk has published updated versions of the Site Import and Migrator extensions that address the improper symlink resolution. Administrators should update both extensions through the Plesk Extensions Catalog and confirm the installed versions match the fixed builds listed in the vendor advisory. Refer to the Plesk Security Advisory CVE-2026-65647 for the exact fixed versions and update instructions.
Workarounds
- Disable or uninstall the Site Import and Migrator extensions on Plesk servers where they are not actively used until the patch can be applied.
- Restrict Plesk panel access to trusted networks using firewall rules or a VPN to reduce the pool of authenticated users who can invoke the vulnerable workflows.
- Enforce strong authentication and multi-factor authentication for all Plesk accounts to limit credential compromise as a precursor to exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
