The Plesk extension "Site Import" versions before 1.13.2 contains a vulnerability due to improper validation of domain and session identifiers. This flaw allows a non-owner subscription user to perform path traversal, redirecting a privileged backend session into a directory they control. Exploitation can lead to arbitrary code execution with root privileges.