What is GHSA-vr33-8mcv-hqqf?

GHSA-vr33-8mcv-hqqf is a security advisory published by GitHub Security Advisories with Critical severity. The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session...

Which CVE IDs does GHSA-vr33-8mcv-hqqf cover?

GHSA-vr33-8mcv-hqqf covers the following CVE IDs: CVE-2026-107246. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-vr33-8mcv-hqqfCritical

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session...

Vendor

GitHub Security Advisories

Published

November 10, 2026

Last Modified

November 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-107246 →

📋 Description

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107246
https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension
https://github.com/advisories/GHSA-vr33-8mcv-hqqf