CVE-2026-44962
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedPlesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidencePlesk contains an XPath injection vulnerability in the APS Application Catalog search functionality where user-supplied input is directly interpolated into XPath queries without sanitization. This allows an authenticated low-privileged user to manipulate XPath expressions and achieve arbitrary operating system command execution, enabling local privilege escalation to root/system level.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm Plesk installationRun 'plesk version' or check for /opt/psa directory existence. On Windows, check for C:\Program Files (x86)\Plesk directory.Affected if Plesk is not installed on the system.
-
Identify Plesk versionExecute 'plesk version' or inspect /opt/psa/version file. Compare the installed version against any available Plesk security advisories.Affected if The installed version has not received the CVE-2026-44962 patch.
-
Verify APS Application Catalog is enabledCheck the Plesk admin interface under 'Applications' or run 'plesk bin aps' to see if APS catalog functionality is available. Look for /opt/psa/admin/plib/modules/aps/ directory.Affected if APS Application Catalog module is present and enabled in the Plesk installation.
-
Check if low-privileged users have APS catalog accessExamine user accounts in Plesk (Server > Users or Subscriptions) to identify non-admin accounts. Verify if these accounts have access to the APS Application Catalog search feature.Affected if Authenticated low-privileged users exist and can access the APS catalog search functionality.
-
Inspect APS search implementation for XPath usageReview /opt/psa/admin/plib/modules/aps/library/catalog.php or similar files for direct XPath query construction using user-supplied parameters.Affected if The APS search code directly incorporates request parameters into XPath queries without parameterization.
A user is affected if Plesk with an unpatched version has the APS Application Catalog enabled and low-privileged users can access its search functionality.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply vendor patch when available; implement parameterized XPath queries or robust input validation/sanitization on all search parameters in the APS Application Catalog; temporarily restrict low-privilege user access to the catalog until patched.
- Consultation4.0 h
- Implementation12.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,808.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-44962 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-44962 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data