CVE-2026-65646

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65646", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-07-22T15:00:06.104Z", "datePublished": "2026-08-26T21:21:41.144Z", "dateUpdated": "2026-09-11T17:16:03.698Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges."}], "affected": [{"defaultStatus": "unaffected", "vendor": "WebPros", "product": "Plesk", "versions": [{"version": "0", "status": "affected", "lessThan": "18.0.79.11", "versionType": "semver"}, {"version": "18.0.80", "status": "affected", "lessThan": "18.0.80.7", "versionType": "semver"}]}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "credits": [{"lang": "en", "value": "Aziz Knani", "type": "reporter"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-11T17:16:03.698Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65646", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T13:01:50.922762Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T15:04:11.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65646", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T13:01:50.922762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:56:15.835Z"}}], "cna": {"credits": [{"lang": "en", "type": "reporter", "value": "Aziz Knani"}], "metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "WebPros", "product": "Plesk", "versions": [{"status": "affected", "version": "0", "lessThan": "18.0.79.11", "versionType": "semver"}, {"status": "affected", "version": "18.0.80", "lessThan": "18.0.80.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-11T17:16:03.698Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65646", "state": "PUBLISHED", "dateUpdated": "2026-09-11T17:16:03.698Z", "dateReserved": "2026-07-22T15:00:06.104Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-08-26T21:21:41.144Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Plesk", "vendor": "WebPros", "versions": [{"lessThan": "18.0.79.11", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "18.0.80.7", "status": "affected", "version": "18.0.80", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges."}], "id": "CVE-2026-65646", "lastModified": "2026-09-11T18:16:57.340", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65646", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T13:01:50.922762Z", "version": "2.0.3"}}]}, "published": "2026-08-26T22:16:26.020", "references": [{"source": "support@hackerone.com", "url": "https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Plesk: Plesk: Remote Privilege Escalation and File Disclosure Vulnerability", "id": "2524740", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524740"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.", "A flaw was found in Plesk. Improper neutralization of special elements allows remote authenticated users to disclose arbitrary local files. This vulnerability can also lead to privilege escalation within the system."], "name": "CVE-2026-65646", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-26T21:21:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-65646\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65646\nhttps://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,18.0.79.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.0.80,18.0.80.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Plesk", "source": "cna", "vendor": "WebPros"}, "product": "plesk", "vendor": "webpros"}], "created": "2026-08-27T00:15:07.298171+00:00", "updated": "2026-09-21T06:30:09.142978+00:00", "vendors": ["webpros", "webpros$PRODUCT$plesk"]}