CVE-2026-44962
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
Risk Assessment
The risk is that an attacker with low privileges can take control of the server by executing arbitrary commands, potentially leading to full system and data compromise.
Recommendation
It is recommended to immediately update Plesk to the latest version that includes a fix for the XPath injection vulnerability. Additionally, restrict access to the APS Application Catalog search functionality to trusted users only.
Original NVD description (English source)
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.