CVE-2026-65646: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in WebPros Plesk

This vulnerability (CWE-74) in Plesk's DNS zone management arises from improper neutralization of special elements in output used by a downstream component. Remote authenticated users can exploit this flaw to read arbitrary local files and escalate their privileges within the system. The affected versions include all releases from initial versions up to but not including 18.0.79.11, and from 18.0.80 up to but not including 18.0.80.7. The CVSS 3.0 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote authenticated users to disclose arbitrary local files and escalate privileges, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected Plesk installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor WebPros advisories for updates and apply patches once available. Until then, restrict access to DNS zone management functionality to trusted users only.