CVE-2026-44962: Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization

Synopsis

Plesk has an XPath injection in the APS Application Catalog search, where unsanitized user input is interpolated directly into XPath queries. An authenticated low-privileged user can reach the affected endpoint over the network and use the injection to run arbitrary operating system commands on the server, leading to full host compromise. Patched-image rebuilds at 18.0.75.1 and 18.0.76.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Plesk web interface over the network to hit the APS Application Catalog search endpoint.

• AuthenticationRequired

  A valid low-privileged Plesk account is sufficient; no administrative role is needed.

• Victim interactionNot required

  Exploitation is driven entirely by the attacker's request and needs no action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or environmental tuning.

Blast Radius

• Executes arbitrary operating system commands on the Plesk host under the service account, enabling local privilege escalation.
• Reads any file or secret accessible to the Plesk process, including hosted site data, database credentials, and API tokens.
• Modifies or destroys hosted website content, configuration, and persisted database rows on the server.
• Disrupts or fully takes the Plesk control panel and the sites it manages offline.