CVE-2026-48614

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48614", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-05-22T15:00:09.276Z", "datePublished": "2026-07-06T16:46:05.644Z", "dateUpdated": "2026-07-06T17:39:05.008Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server."}], "affected": [{"defaultStatus": "unaffected", "vendor": "WebPros", "product": "Plesk", "versions": [{"version": "0", "status": "affected", "lessThan": "18.0.78", "versionType": "semver"}]}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-94", "description": "CWE-94 Code Injection"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-06T16:46:05.644Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T17:38:57.574170Z", "id": "CVE-2026-48614", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:39:05.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T17:38:57.574170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T17:39:00.753Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "WebPros", "product": "Plesk", "versions": [{"status": "affected", "version": "0", "lessThan": "18.0.78", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API"}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Code Injection"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-06T16:46:05.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48614", "state": "PUBLISHED", "dateUpdated": "2026-07-06T17:39:05.008Z", "dateReserved": "2026-05-22T15:00:09.276Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-07-06T16:46:05.644Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Plesk", "vendor": "WebPros", "versions": [{"lessThan": "18.0.78", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n impropia en la API XML de Plesk permite a un usuario autenticado inyectar directivas de configuraci\u00f3n arbitrarias, resultando en escritura de archivos arbitrarios como root y escalada total de privilegios en el servidor subyacente."}], "id": "CVE-2026-48614", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48614", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T17:38:57.574170Z", "version": "2.0.3"}}]}, "published": "2026-07-06T18:16:46.130", "references": [{"source": "support@hackerone.com", "url": "https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Plesk: Plesk: Privilege escalation via improper authorization in XML API", "id": "2497412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497412"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-15", "details": ["An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.", "A flaw was found in Plesk. An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives. This can result in arbitrary file write as root, leading to full privilege escalation on the underlying server."], "mitigation": {"lang": "en:us", "value": "Red Hat OpenShift Dev Spaces is not affected because it does not ship or rely on Plesk or expose the Plesk XML API. The vulnerable functionality resides within the Plesk-specific integration of the go-acme/lego library, which is not used by the product. Authentication is also required to exploit the vulnerability. No product changes are required."}, "name": "CVE-2026-48614", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-07-06T16:46:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48614\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48614\nhttps://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API"], "statement": "Critical:An improper authorization vulnerability exists in the Plesk XML API that allows an authenticated user to inject arbitrary configuration directives, potentially resulting in arbitrary file writes as root and privilege escalation. Although the go-acme/lego dependency is present, Red Hat OpenShift Dev Spaces does not ship or use the affected Plesk functionality. Therefore, the vulnerable code path is not exposed in this product.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,18.0.78)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Plesk", "source": "cna", "vendor": "WebPros"}, "product": "plesk", "vendor": "webpros"}], "created": "2026-07-06T18:30:05.388253+00:00", "updated": "2026-08-01T18:30:05.022101+00:00", "vendors": ["webpros", "webpros$PRODUCT$plesk"]}