CVE-2025-66430
📋 TL;DR
CVE-2025-66430 is an incorrect access control vulnerability in Plesk's Password Protected Directories feature that allows authenticated Plesk users to escalate privileges and gain root-level access to the server. This affects Plesk 18.0 installations with the vulnerable feature enabled. Attackers can compromise the entire server if they have any Plesk user account.
💻 Affected Systems
- Plesk
📦 What is this software?
Plesk by Plesk
Plesk by Plesk
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with root access, allowing complete control over the system, data theft, installation of persistent backdoors, and lateral movement to other systems.
Likely Case
Authenticated attackers with Plesk accounts gain root privileges, enabling them to access all customer data, modify configurations, and install malicious software.
If Mitigated
With proper access controls and monitoring, impact is limited to specific directories, but privilege escalation risk remains if exploited.
🎯 Exploit Status
Exploitation requires authenticated access to Plesk, but the vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Plesk 18.0.60 or later
Vendor Advisory: https://support.plesk.com/hc/en-us/articles/36261922405015
Restart Required: No
Instructions:
1. Log into Plesk admin panel. 2. Navigate to Tools & Settings > Updates and Upgrades. 3. Install all available updates. 4. Verify version is 18.0.60 or higher.
🔧 Temporary Workarounds
Disable Password Protected Directories
linuxTemporarily disable the vulnerable feature until patching is possible
plesk bin extension --disable password-protected-directories
🧯 If You Can't Patch
- Restrict Plesk user accounts to only trusted administrators
- Implement network segmentation to isolate Plesk servers from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check Plesk version and if Password Protected Directories extension is enabled in Plesk admin panelCheck Version:
plesk versionVerify Fix Applied:
Verify Plesk version is 18.0.60 or higher and test privilege escalation attempts fail📡 Detection & Monitoring
Log Indicators:
- Unusual root-level commands from Plesk users
- Unauthorized access to protected directories
- Privilege escalation attempts in system logs
Network Indicators:
- Unexpected outbound connections from Plesk server
- Unusual authentication patterns to Plesk admin interface
SIEM Query:
source="plesk.log" AND ("privilege escalation" OR "root access" OR "unauthorized directory access")