A newly discovered vulnerability in Plesk Backup Manager, identified as CVE-2026-68488, poses a serious risk to Linux servers by allowing low-privileged users to escalate their permissions and gain root access. This flaw arises from a symlink race condition during subscription content restore operations. It impacts Plesk Obsidian installations on Linux, specifically versions 18.0.80.6 and earlier, as well as 18.0.79.10 and earlier. Notably, Plesk for Windows is not affected.
The vulnerability occurs within the Backup Manager workflow when restoring content associated with a customer subscription. Users with standard access to the Plesk Panel and FTP access to their own subscription can exploit this issue by manipulating symbolic links, or symlinks, during the restore process. Symlinks are essentially pointers to files or directories, and an attacker can potentially alter these paths to gain ownership of files outside their designated subscription.
Since restore operations may execute with elevated privileges, a successful exploit could allow an attacker to take control of sensitive files or directories, ultimately leading to full root-level access to the server. This is particularly concerning for shared hosting environments, managed servers, and multi-tenant Plesk setups where such access should not be possible.
While exploitation requires valid access to a Plesk subscription, making this not an unauthenticated remote code execution vulnerability, its impact is still severe. Successful attacks can lead to complete server compromise. Plesk has addressed this vulnerability by releasing patched versions. Users of the 18.0.80 release line should update to Plesk Obsidian 18.0.80.7 or later, while those on the 18.0.79 branch should upgrade to version 18.0.79.11 or later.
Administrators are urged to prioritize patching especially on internet-facing and multi-tenant servers, where customers have FTP access and can initiate backup or restore functions. Hosting providers should review user accounts, permissions, and recent restore activities for any unusual ownership changes. Security teams are advised to monitor for unusual file ownership changes outside customer web roots, unexpected symlinks in subscription directories, and suspicious Backup Manager activity. Reviewing privileged filesystem changes and authentication logs can help detect exploitation attempts. Plesk acknowledged security researchers Ali Mustafa, known as rz1027, and abed1526 for responsibly reporting this vulnerability.
