Brief Summary: CVE-2026-44962, Critical XPath Injection to Root in Plesk APS Catalog

Introduction

An XPath injection flaw in the search feature of Plesk's APS Application Catalog lets any authenticated low-privileged user chain a data-layer injection into full root-level command execution on the underlying server. The CVSS score is 9.9, and Plesk is widely deployed across shared hosting infrastructure, so this vulnerability turns any customer, reseller, or domain owner account into a potential path to complete server compromise.

Plesk is one of the two dominant web hosting control panels globally (alongside cPanel), and it provides server automation and management for retail hosting providers. Plesk International GmbH developed it, and it is now part of WebPros. It runs on shared hosting infrastructure where multiple tenants routinely share a single server instance. A privilege escalation in Plesk therefore potentially affects every tenant on the server, rather than a single site or user.

Technical Information

Vulnerability Classification and Root Cause

CVE-2026-44962 is classified under CWE-643 (Improper Neutralization of Data within XPath Expressions), which describes a condition where "the product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input." It is also related to CWE-91 (XML Injection / Blind XPath Injection).

The root cause is in the search functionality of the APS (Application Packaging Standard) Catalog. The APS Catalog was a Plesk web service that provided access to a large collection of web applications packaged in the APS format. Plesk distinguishes between the "Application Catalog" (a remote repository held by Plesk as the main source of apps) and the "Application Vault" (a local repository). Internally, the catalog stored its data as XML and built search queries with XPath. User-supplied input from the search field was interpolated directly into these XPath queries without proper sanitization.

XPath Injection Mechanics

XPath injection follows patterns similar to SQL injection but targets XML data stores. As defined by OWASP, XPath injection "occurs when a web site uses user-supplied information to construct an XPath query for XML data." Common techniques include injecting expressions that alter query logic, extracting XML document structure through blind injection, and in advanced cases, using XPath extension functions that may enable file access or command execution.

The CWE-643 definition notes that without proper neutralization, attackers can "modify the syntax, content, or commands of the XPath expression." In CVE-2026-44962, the injected expressions went past data extraction or authentication bypass in the XML layer. They reached code paths within Plesk that executed operating system commands with elevated privileges.

Attack Flow

Based on the available information, exploitation proceeds in five steps:

The attacker authenticates to the Plesk web interface with any low-privileged account. In shared hosting environments, this could be a customer, reseller, or domain owner account.
The attacker navigates to the APS Application Catalog search functionality, which is accessible through the Plesk panel.
The attacker crafts a search input containing XPath injection payloads designed to break out of the intended query structure and manipulate the expression logic.
The injected XPath expression reaches backend processing logic that executes OS commands. This is where the escalation happens. The APS Catalog backend apparently passes data from XPath query results to functions capable of shell command execution.
The backend processes that handle APS Catalog queries run with higher system privileges than the authenticated user. The attacker therefore gets arbitrary command execution as a privileged user, which amounts to local privilege escalation to root.

Why This Is Unusual

Most XPath injection vulnerabilities are limited in impact to data extraction or authentication bypass within the XML data layer, so a chain from XPath injection to OS command execution is uncommon. That CVE-2026-44962 reaches arbitrary OS command execution indicates a deeper architectural flaw. The APS Catalog backend likely passed unsanitized data from XPath query processing to shell execution functions running with elevated privileges. The same weak enforcement of privilege boundaries appears in the related CVE-2025-66430 (Password Protected Directories to root), which suggests a systemic architectural issue more than an isolated coding error.

Prerequisites

Factor	Detail
Authentication	Required: any authenticated low-privileged Plesk user
Network Access	Remote access to Plesk web interface (typically port 8443)
Affected OS	Plesk for Linux
User Privilege Needed	Low-privileged Plesk account (customer, reseller, or domain owner)
Impact	Arbitrary OS command execution, local privilege escalation to root

Affected Systems and Versions

The vulnerability affects Plesk Obsidian installations where the APS Catalog is enabled:

Plesk Obsidian 18.0.76 and earlier (prior to Update 2 / version 18.0.76.2)
Plesk Obsidian 18.0.75 and earlier (prior to Update 1 / version 18.0.75.1)
Any Plesk Obsidian version prior to 18.0.77 where the APS Catalog has not been explicitly disabled via panel.ini

The following versions contain the fix:

Plesk Obsidian 18.0.76.2 (18.0.76 Update 2, released February 25, 2026)
Plesk Obsidian 18.0.75.1 (18.0.75 Update 1, released February 24, 2026)
Plesk Obsidian 18.0.77 and later (APS Catalog removed entirely, released April 2026)

The vulnerability requires the APS Catalog to be enabled and accessible. Installations that disable the APS Catalog with the [aps] enabled = off configuration in panel.ini are not exploitable through this vector.

Vendor Security History

Plesk's recent security record shows a recurring pattern of privilege escalation: low-privileged authenticated users reaching root-level access through different Plesk features.

CVE	Feature	Impact	Timeline
CVE-2025-66430	Password Protected Directories	Plesk users gain root-level access	December 2025
CVE-2026-44962	APS Catalog search (XPath injection)	Authenticated LPE to root via OS command execution	February 2026 fix, May 2026 NVD

Both vulnerabilities have the same impact (root-level server compromise from a low-privileged starting point) and sit in the same category of attack surface (authenticated web interface features). This points to an architectural pattern where Plesk features accessible to low-privileged users execute backend operations with excessive system privileges.

Plesk chose to deprecate and remove the entire APS Catalog in version 18.0.77 instead of only patching the XPath injection. That may indicate Plesk assessed the component as fundamentally insecure or unsustainable to maintain. Removal is a pragmatic fix, but it also raises the question of whether other Plesk components share similar architectural weaknesses.

Plesk's security response process was good. Georgii Shutiaev disclosed the vulnerability responsibly through HackerOne, and Plesk released patches approximately three months before the NVD publication. The February 2026 security update fixed multiple vulnerabilities at once across the 18.0.75 and 18.0.76 release branches.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information