CVE-2026-68488 is a time-of-check time-of-use race condition leading to insecure symlink following in Plesk's Backup Manager, which allows a low-privileged hosting customer to take ownership of files outside their own subscription and escalate to root on the underlying Linux server. NVD records a CVSS 3.0 base score of 9.9 (Critical) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network reachability, low privileges required and a scope change from the vulnerable component to the host operating system.

The flaw sits in the restore path for a customer subscription's content. A user holding ordinary Plesk Panel access plus FTP access to their own subscription can manipulate a symbolic link while a restore operation runs, so that Plesk — which performs restores with elevated privileges — changes ownership of a file or directory outside the attacker's assigned subscription. Ownership of a sensitive file or directory is then sufficient to reach root-level control of the host.

Plesk for Windows is not affected. The affected Linux builds are Plesk Obsidian 18.0.80.6 and earlier on the 18.0.80 line, and 18.0.79.10 and earlier on the 18.0.79 line; the fixed builds are 18.0.80.7 or later and 18.0.79.11 or later respectively. The vulnerability is not unauthenticated remote code execution — valid subscription access is a precondition — but the boundary it breaks is the one shared and multi-tenant hosting is built on: that one customer's account cannot affect files outside its own environment. Plesk credited researchers Ali Mustafa (rz1027) and abed1526.

Hosting providers should watch for unexpected ownership changes on files outside customer web roots, new symlinks inside subscription directories, and restore-related activity that does not correspond to a customer request.

Source

• Plesk — Vulnerability in Plesk's Backup Manager: symlink race during restore allows root privilege escalation
• Cyber Security News — Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to Servers