Loading vulnerability…
Privilege Escalation in Plesk Password-Protected Directories
CVE-2025-66430 is a critical privilege-escalation vulnerability in Plesk for Linux affecting the Password-Protected Directories feature. The flaw stems from incorrect access control and insufficient privilege boundary enforcement in functionality that permits a low-privileged authenticated Plesk user with access to this feature to inject arbitrary data into Apache configuration files. Because the affected backend operations execute with elevated system privileges, a successful attacker can leverage the configuration injection path to trigger command execution as root on the underlying server. Reported affected versions include Plesk 18.0.70 through 18.0.74, and Plesk Onyx installations are also reported as impacted.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows escalation from a low-privileged authenticated Plesk account to root on the affected Linux server. This can result in full server compromise, unauthorized modification of web server configuration, execution of arbitrary commands with the highest local privileges, theft or manipulation of hosted data, malware deployment, persistence establishment, and potential lateral movement to other systems reachable from the compromised host.
If you can’t patch tonight, do this now.
Until patches can be applied, restrict or disable access to the Password-Protected Directories feature for untrusted or low-privileged users, especially customer, domain, or reseller accounts that do not strictly require it. Minimize the number of users permitted to manage protected directories, closely monitor for unexpected Apache configuration changes and suspicious privileged command execution, and review Plesk role assignments and access controls to reduce exposure. Network isolation and tighter administrative oversight of shared hosting tenants can further reduce exploitation risk, but these measures do not replace patching.
Patch, then assume compromise.
Apply the vendor-provided security updates for affected Plesk releases immediately. Reported fixes include micro-updates 18.0.73.5 and 18.0.74.2, and administrators should upgrade to the latest supported patched version available for their branch. Plesk Onyx installations should also be updated to a vendor-remediated release if still supported, or migrated to a supported version. After patching, review Apache-related configuration for unauthorized changes and audit privileged actions performed through the Password-Protected Directories feature.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.