Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges. (CVE-2026-65646)

CVE-2026-65646 is a vulnerability in Plesk caused by improper neutralization of special elements, which enables remote authenticated users to disclose arbitrary local files and escalate privileges. This vulnerability falls under CWE-74, indicating improper neutralization of special elements used in a security-sensitive context. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation details are available from the provided data.

Exploitation of this vulnerability could allow a remote authenticated attacker to read arbitrary local files on the system and escalate their privileges, potentially leading to unauthorized access and control over the affected system. The high severity rating reflects significant risk to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates and consider restricting access to Plesk interfaces to trusted users only until a fix is available.