CVE-2026-67397CWE-22path-traversal

CVE-2026-67397

published September 4, 2026

CVSS
8.5
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T04:17Z
References (1)
https://support.plesk.com/hc/en-us/articles/43070000520855-Vulnerability-CVE-2026-67397-Arbitrary-code-execution-as-root-in-Plesk · [email protected]
EPSS history
Timeline
  • 05 SEP 03:43Z
    EPSS moved — → 0%
    epss
  • 03 SEP 23:57Z
    Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root
    cvelistv5