CVE-2026-67397 - Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root

HIGH

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root

Published Sep 3, 2026

8.5

HIGH

CVSS 4.0

EPSS 0.17%

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

Vendor WebPros Product Plesk Default
unaffected
Affected
- ≥ 0, < 18.0.79.9
- ≥ 18.0.80, < 18.0.80.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
WebPros	Plesk	unaffected	Affected ≥ 0, < 18.0.79.9 ≥ 18.0.80, < 18.0.80.5

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70851		Advisory
https://support.plesk.com/hc/en-us/articles/43070000520855-Vulnerability-CVE-2026-67397-Arbitrary-code-execution-as-root-in-Plesk

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Sep 3, 2026

Updated Sep 4, 2026

Reserved Jul 29, 2026

CISA Vulnrichment

Updated Sep 4, 2026

NVD

Status Awaiting Analysis

Modified Sep 8, 2026

Red Hat

No data

ENISA EUVD

Assigner hackerone

Published Sep 3, 2026

Updated Sep 4, 2026

GitHub

No data