CVE-2026-44962 is an XPath injection in the APS Application Catalog search function in Plesk for Linux. User input is inserted into XPath queries without proper sanitization, allowing an authenticated low-privileged user to execute operating-system commands and elevate privileges locally. HackerOne's CNA assessment is CVSS v3.1 9.9 CRITICAL, not 10.0.
Vulnerability Overview and Scope of Impact
This vulnerability, 'CVE-2026-44962', stems from an XPath injection flaw in the search function of Plesk for Linux's APS application catalog. Because user-provided input is not properly sanitized before being inserted into XPath queries, attackers can use crafted input to bypass application logic and freely execute OS commands as an authenticated low-privileged user.
This could lead to devastating damage, such as access to sensitive information, website defacement, destruction of server resources, and even complete server takeover. Especially in shared hosting environments and multi-tenant systems, the potential for widespread damage is high, requiring immediate action.
Specific Impacts and Attack Scenarios
If an attacker possesses valid login credentials for Plesk (even if they are very low-privileged), they can inject malicious XPath queries through the APS application catalog's search function. This query is processed by the server's backend, resulting in the execution of arbitrary OS commands intended by the attacker with root privileges.
For example, it is possible to read server configuration files (e.g., `/etc/passwd`), stop critical services, and even upload and execute malware. This poses a risk of complete compromise to websites running Plesk and their associated data.
Measures Engineers Should Take Immediately
Update the applicable branch to Plesk 18.0.75.1, 18.0.76.2, or later. After updating, review low-privileged users, added files, scheduled jobs, service changes, and administrative logs.
Blocking a guessed APS route in Nginx can break legitimate functions without preventing exploitation. If immediate updating is impossible, avoid an improvised rule and obtain a mitigation appropriate to the deployed release directly from Plesk support.
📦