Critical Privilege Escalation Vulnerability in Plesk for Linux

A critical security vulnerability, tracked as CVE-2025-66430, has been identified in Plesk for Linux, specifically affecting the Password-Protected Directories feature. This flaw allows authenticated Plesk users to inject arbitrary data into Apache configuration files, leading to local privilege escalation and enabling attackers to execute commands with root-level privileges. The vulnerability poses a severe risk of complete server compromise, data theft, malware installation, and lateral movement within affected environments. Plesk versions 18.0.70 through 18.0.74, including Plesk Onyx installations, are impacted, and security updates have been released to address the issue. Administrators are strongly advised to apply the latest micro-updates (18.0.73.5 and 18.0.74.2) immediately to mitigate the risk.

The vulnerability is the result of improper access control and insufficient input validation within the Password-Protected Directories feature. Exploitation requires access to a Plesk user account, but once achieved, attackers can escalate privileges to root, representing a significant threat to organizations relying on Plesk for server management. The issue is classified as critical, with a CVSS score of 9.1, and is remotely exploitable. Official Plesk documentation provides detailed guidance for patching affected systems, and prompt remediation is essential to prevent exploitation in the wild.