CVE-2026-44962

The record

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Affected packages

Related vulnerabilities

• CVE-2026-40699 A vulnerability exists in the undisclosed pages in the Configuration utility that may… CWE-643
• CVE-2026-24343 Improper Neutralization of Data within XPath Expressions ('XPath Injection')… CWE-643
• GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability CWE-643
• CVE-2022-50807 Concrete5 CMS contains an XPath injection vulnerability CWE-643