CVE-2026-68488

WebPros / Plesk PUBLISHED

Description (CNA)

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

Affected (CNA)

Vendor / product	Versions
WebPros / Plesk	affected 0 through 18.0.80.6; affected 0 through 18.0.79.10

CWE

CWE-367

References

https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.