CVE-2026-65647: CWE-59 Improper Link Resolution Before File Access ('Link Following') in WebPros Plesk Migrator

This vulnerability arises from improper handling of symbolic links before accessing files in the Plesk Migrator product by WebPros. Remote authenticated attackers can exploit this flaw to execute arbitrary code as the root user, potentially leading to full system compromise. The CVSS 4.0 base score is 8.7, reflecting high impact and exploitability with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the affected versions have not been explicitly stated.

Successful exploitation allows remote authenticated users to execute arbitrary code with root privileges on the affected system. This can lead to complete system compromise, including unauthorized access, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Plesk Migrator service to trusted users only and monitor for suspicious activity related to file access and symbolic link usage.