CVE-2025-66431
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66431?
CVE-2025-66431 is considered a high severity vulnerability due to its ability to allow remote authenticated users to execute arbitrary code as root.
How do I fix CVE-2025-66431?
To fix CVE-2025-66431, update your WebPros Plesk installation to version 18.0.74.2 or later, or 18.0.73.5.
Who is affected by CVE-2025-66431?
CVE-2025-66431 affects users of WebPros Plesk versions prior to 18.0.73.5 and between 18.0.74 and 18.0.74.2 on Linux.
What type of attack does CVE-2025-66431 facilitate?
CVE-2025-66431 facilitates a remote code execution attack through improper authorization in the domain creation process.
What permissions are required to exploit CVE-2025-66431?
To exploit CVE-2025-66431, the attacker must have permissions to create and manage sites, specifically with 'Domains management' and 'Subdomains management' rights.