IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.7High

CVE-2026-68489

WebPros Plesk extension "Ruby"; WebPros Plesk extension "Node.js Toolkit" Published: (2 months ago)

Description

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Weakness (CWE): CWE-96

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
WebPros Plesk extension "Node.js Toolkit" < 2.5.0
WebPros Plesk extension "Ruby" < 1.6.6

References and patches

Recent CVEs in the same product — Plesk

8.4High
CVE-2026-82977
WebPros Plesk

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.

9.2Critical
CVE-2026-107246
WebPros Plesk extension "Site Import"

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbit…

8.7High
CVE-2026-68492
WebPros Plesk; WebPros Plesk extension "Plesk RESTful API"

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

9.4Critical
CVE-2026-87898
WebPros Plesk extension "Site Import"

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

1.1%EPSS
9.9Critical
CVE-2026-68487
WebPros Plesk

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

9.9Critical
CVE-2026-68488
WebPros Plesk

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.