CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog

Configurations

No configuration.

History

21 Jul 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Plesk contiene una vulnerabilidad de inyección XPath en la funcionalidad de búsqueda del Catálogo de Aplicaciones APS, donde la entrada proporcionada por el usuario se interpola en consultas XPath sin una sanitización adecuada. Esto permite a un usuario autenticado y con bajos privilegios ejecutar comandos arbitrarios del sistema operativo en el servidor, lo que resulta en una escalada local de privilegios.

29 May 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 16:16

Updated : 2026-07-21 15:10

NVD link : CVE-2026-44962

Mitre link : CVE-2026-44962

CVE.ORG link : CVE-2026-44962

JSON object : View

Products Affected

No product.

CWE

CWE-643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

{"id": "CVE-2026-44962", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44962", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T16:43:11.003611Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "WebPros", "product": "Plesk", "versions": [{"status": "affected", "version": "18.0.75.1", "lessThan": "18.0.75.1", "versionType": "semver"}, {"status": "affected", "version": "18.0.76.2", "lessThan": "18.0.76.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T16:16:27.567", "references": [{"url": "https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog", "source": "support@hackerone.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-643"}]}], "descriptions": [{"lang": "en", "value": "Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation."}, {"lang": "es", "value": "Plesk contiene una vulnerabilidad de inyecci\u00f3n XPath en la funcionalidad de b\u00fasqueda del Cat\u00e1logo de Aplicaciones APS, donde la entrada proporcionada por el usuario se interpola en consultas XPath sin una sanitizaci\u00f3n adecuada. Esto permite a un usuario autenticado y con bajos privilegios ejecutar comandos arbitrarios del sistema operativo en el servidor, lo que resulta en una escalada local de privilegios."}], "lastModified": "2026-07-21T15:10:00.103", "sourceIdentifier": "support@hackerone.com"}