CVE-2026-65647

Executive Summary

CVE-2026-65647 is an improper symlink resolution vulnerability (CWE-59) in Plesk, a widely deployed web hosting control panel. The flaw allows remote authenticated users to exploit symlink handling before file access operations, achieving arbitrary code execution with root privileges. Given that Plesk manages thousands of virtual hosts, DNS zones, and mail services on a single server, this vulnerability poses a critical risk to hosting providers and enterprise environments that rely on Plesk for multi-tenant server administration. As of this writing, the vulnerability remains unpatched, with no vendor advisory, no CISA KEV listing, and no public proof-of-concept available; the exact affected version range has not been disclosed.

Technical Analysis

The root cause of CVE-2026-65647 falls under CWE-59, Improper Link Resolution Before File Access (aka 'Link Following'). This vulnerability class occurs when a software component resolves a symbolic link and then performs a file operation (open, write, delete, or execute) without sufficiently validating that the target path is not a maliciously crafted symlink.

In the context of Plesk, the attack surface is significant. Plesk is a control panel that provides administrative interfaces for domain management, file management, database administration, cron job scheduling, and mail server configuration. Many of these operations involve file access on behalf of the authenticated user, often operating at elevated privileges (e.g., the psa system user or even root via sudo wrappers). The NVD description indicates that "improper symlink resolution before file access" allows the attacker to redirect file operations to arbitrary filesystem locations.

The precise technical mechanism involves a time-of-check-to-time-of-use (TOCTOU) race or a simple lack of symlink validation. In affected operations, Plesk likely checks a file path (e.g., to verify the user owns the file) and then subsequently opens or writes to that file. If an attacker can swap a legitimate file with a symlink pointing to a critical system file (such as /etc/passwd, /etc/shadow, or a root-owned binary), the subsequent file operation is performed against the symlink target with elevated privileges. This is a classic "symlink attack" that, when executed against a process running as root, yields arbitrary file write or arbitrary code execution.

Insufficient technical detail is available regarding the specific function names, endpoints, or parameters vulnerable in Plesk. The NVD description provides no CNA title, no vendor reference, and no specific file paths within the Plesk application. The analysis presented here is derived strictly from the vulnerability class (CWE-59) and the stated impact (root-level code execution). It is highly probable that the vulnerable code path exists within a PHP or C++ component of Plesk that handles file management (e.g., the file manager module), backup/restore operations, or domain configuration file writes.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the Plesk multi-tenant architecture. No public PoC exists; therefore, the steps below describe the generic exploit pattern for CWE-59 in a hosting control panel context.

Step 1 — Reconnaissance & Target Identification: The attacker requires valid credentials for a Plesk account, which can be a reseller, a domain administrator, or a mail user. Attackers may obtain credentials via phishing, credential stuffing against exposed Plesk login portals (typically on TCP 8443), or from prior data breaches. Shodan dorks such as product:"Plesk" or http.title:"Plesk" can identify internet-exposed panels. The attacker identifies the Plesk version and likely vulnerable features by reviewing the panel's feature set.

Step 2 — Symlink Setup (Triggering the Flaw): The attacker locates a Plesk feature that performs file operations with elevated privileges based on a user-supplied path. A common pattern in hosting panels is the "File Manager" web interface, which allows users to upload, edit, rename, and delete files within their home directory. The attacker creates a legitimate file (e.g., a placeholder) in their home directory. They then perform an operation that replaces that file with a symbolic link pointing to a sensitive system target. For example, in a file manager context, the attacker might create a symlink via a "paste as link" feature (if supported) — or more likely, via an uploaded crafted archive (tar/zip) that contains a symlink entry. The crafted archive, when extracted by Plesk's archive management, creates a symlink at a predictable location, pointing to /etc/passwd or another writable system path.

Step 3 — Triggering Privileged File Access: The attacker invokes a Plesk operation that accesses the crafted symlink with elevated privileges. This could be a backup operation that reads files in the web directory, a log rotation script that follows symlinks, or a permission-fixing routine (e.g., chown or chmod) that operates on the user's files. Because Plesk fails to validate that the target is a regular file owned by the user (i.e., improper symlink resolution before file access), the privileged process follows the symlink and performs the operation on the target file.

Step 4 — Execution & Post-Exploitation: With arbitrary file write as root, the attacker executes code by writing to a root-scheduled location (e.g., /etc/cron.d/), overwriting a systemd unit file, or modifying a root-executed script. Alternatively, if the vulnerable operation supports file read, the attacker can exfiltrate sensitive files (e.g., /etc/shadow, database credentials in /etc/psa/.psa.shadow). Full compromise of the Plesk host (root shell) is the expected outcome. Post-exploitation includes deploying web shells on any virtual host, installing kernel rootkits, harvesting credentials of other Plesk users (via database access), and pivoting to other servers hosted on the same physical infrastructure.

Impact Assessment

Business Impact: Critical. Plesk is commonly deployed on single-server hosting environments where the control panel has unrestricted root access to the operating system. Exploitation leads to complete server takeover. For managed service providers, a single compromise exposes all customer websites, databases, and email accounts hosted on the server, representing a severe data breach with legal, regulatory, and reputational consequences.

Affected Systems: All Plesk installations employing file-access features susceptible to symlink following. This includes Plesk Web Host Edition, Web Pro, and Web Admin SKUs across Linux distributions (CentOS, Ubuntu, Debian, AlmaLinux) and Windows Server, where symlink resolution is relevant (NTFS junctions/JCT points are analogous).

Blast Radius: Full server compromise; lateral movement potential if the compromised server holds SSH keys or VPN credentials; potential supply-chain risk if the compromised Plesk instance is used to distribute customers' web content (e.g., via malware injection into hosted sites).

CVSS Reference: While the official CVSS score is listed as N/A, a practical assessment reflects a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, scoring approximately 7.2 (High). The exploitability is "High" due to the requirement of valid low-privilege user credentials; the confidentiality, integrity, and availability impact are each "High" due to root-level code execution.

Detection Guidance

The following detection rules are designed to identify exploitation attempts. Since the exact vulnerable endpoint is not publicly known, these rules focus on the observable effects and class-level patterns of symlink attacks in a Plesk environment.

Sigma Rule

title: Plesk Symlink Dereference Privilege Escalation Attempt
id: 6f4a2c8e-9d34-4c4b-8a1f-7d2c93b1e5a0
status: experimental
description: Detects suspicious file system operations by Plesk processes that resolve symlinks to non-standard locations, indicating a potential CVE-2026-65647 exploitation.
logsource:
  category: file_event
  product: linux
detection:
  selection_plesk_procs:
    Image|startswith:
      - '/usr/local/psa/'
      - '/usr/sbin/psa-'
      - '/usr/lib/plesk-'
  selection_symlink_targets:
    TargetFilename|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/sudoers'
      - '/root/'
      - '/etc/cron.'
      - '/etc/systemd/system'
  condition: selection_plesk_procs and selection_symlink_targets
falsepositives:
  - Legitimate Plesk backup/restore operations touching system files (rare)
level: high

YARA Rule

rule Plesk_Symlink_Exploit_CVE_2026_65647
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious web archives or shell scripts containing symlink references targeting system paths for Plesk exploitation."
        cve = "CVE-2026-65647"
    strings:
        $symlink_magic = { 4C 6E ?? 00 00 00 } // 'L' 'n' + unknown + padding (tar symlink header)
        $etc_passwd = "/etc/passwd"
        $etc_shadow = "/etc/shadow"
        $root_path = "/root/"
        $cron = "/etc/cron."
        $systemd = "/etc/systemd/system"
        $sa = "symlink"
        $ln = "ln -s"
    condition:
        uint16(0) == 0x8B1F and // tar magic check (ustar)
        (
            (
                (uint32(148) == 0x4C6E0000) or // GNU tar symlink header indicator
                ($sa and $ln)
            ) and
            (1 of ($etc_* , $root_path, $cron, $systemd))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Plesk CVE-2026-65647 Suspicious File Upload with Symlink Content"; flow:to_server,established; content:"Content-Disposition"; http_header; pcre:"/filename=\".*\.(tar|zip|gz)\"/i"; file_data; content:"link"; pcre:"/ustar|Rar!|PK\x03\x04/i"; fileext:"tar"; content:"/etc/"; sid:202665647; rev:1; metadata:attack_target Web_Server, deployment Perimeter, cve CVE-2026-65647, tag Exploit_KIT;)

Note: This rule detects inbound WebDAV/HTTP uploads of archive files containing path traversal to system directories. Actual exploitation may also occur via the panel's web interface (HTTPS on 8443), requiring the rule to monitor that port or a decrypting proxy.

Elastic Detection

// Detects Plesk-managed processes accessing sensitive system files directly
sequence by host.name with maxspan=5m
  [ process where process.name : "psa-*" or process.executable : "/usr/local/psa/*" ]
  [ file where file.path : ("/etc/passwd", "/etc/shadow", "/etc/sudoers", "/root/*", "/etc/cron.*", "/etc/systemd/system/*") ]

Splunk SPL Query

index=linux_audit OR index=syslog
  (process_name=psa* OR executable_path=/usr/local/psa/*)
  AND (file_path=/etc/passwd OR file_path=/etc/shadow OR file_path=/etc/sudoers OR file_path="/root/*" OR file_path="/etc/cron.*" OR file_path="/etc/systemd/system/*")
  | stats count by host, process_name, file_path, action
  | where count > 0 AND NOT action="denied"
  | table _time, host, process_name, file_path, action, user

Wazuh OSSEC Rule

<group name="plesk,">
  <rule id="100265" level="12">
    <decoded_as>syslog</decoded_as>
    <field name="program">^psa</field>
    <regex>(\/etc\/passwd|\/etc\/shadow|\/etc\/sudoers|\/root\/|\/etc\/cron\.) </regex>
    <description>Plesk process accessing sensitive system path - potential CVE-2026-65647 exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix is available from any tracked source at this time. The following measures should be treated as interim compensating controls until Plesk releases an official security update.

1) Immediate Mitigations:

• Disable Plesk File Manager: If the vulnerable component is the web-based file manager, disable it for all users via service plans. This limits the exposed attack surface.
• Restrict FTP/WebDAV Write Access: Symlink creation via archive upload or FTP is a primary attack vector. Temporarily disable FTP/WebDAV service or restrict write access to web content directories.
• Apply Filesystem Hardening: Mount user home directories and vhosts with the nosymlink mount option where feasible (recent Linux kernels support nosymfollow mount flag). This prevents symlink creation in those filesystems.
• Enable SELinux/AppArmor: Enforce strict MAC policies on Plesk daemon processes. Deny psa-* processes from writing to /etc/, /root/, and /usr/local/ unless explicitly allowed.

2) Patch/Upgrade Steps:

• Monitor Plesk's official security advisories and the Plesk blog for a patch release. The fix will likely be delivered via plesk installer or yum/apt update channels.
• Upon release, apply the patch immediately after testing in a staging environment replicating the production configuration.
• As an interim step, manually update Plesk's psa-file-manager and psa-ftpcopy components if a partial fix is released before the full patch cycle.

3) Long-Term Hardening:

• Least Privilege: Never give domain administrators full control over raw file system paths. Use Plesk's built-in "File Manager" permission scoping to limit directory access.
• Audit Logs: Enable and retain all file-related audit logs (e.g., auditd on Linux) with a retention period of at least 12 months for threat hunting.
• Multi-Factor Authentication: Enforce 2FA for all Plesk user accounts (admin, reseller, and web space owners) to reduce the risk of credential compromise leading to this attack.
• Network Exposure: Restrict access to the Plesk panel (port 8443) to VPN or trusted IP ranges using firewall rules or reverse proxy ACLs.
• Monitor CISA KEV: Although not currently listed, this vulnerability carries high exploit potential. Re-check the CISA Known Exploited Vulnerabilities catalog daily and expedite patching if it is added.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65647
2. CWE-59 (Improper Link Resolution Before File Access): https://cwe.mitre.org/data/definitions/59.html — Referenced for the vulnerability class mechanism.
3. ATT&CK Technique T1068 - Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/ — Referenced for the MITRE tactic mapping.
4. Plesk Official Security Advisories: https://support.plesk.com/hc/en-us/sections/115001978849-Security-Advisories — Monitor for the Vendor Fix. Note: No advisory has been published at the time of this writing.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No current listing for CVE-2026-65647; monitor for updates.

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to this CVE at the time of writing. No exploit code has been released, and the vulnerability is not listed on Exploit-DB or the Metasploit Framework. However, given the high value of Plesk targets (shared hosting servers), the expectation is that nation-state actors or financially motivated groups will develop exploits once technical details leak or a patch differential analysis is performed.