Description

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-07T18:17:20.070Z",
  "pubdate": "2026-08-07T18:17:20.070Z",
  "executiveSummary": "An SQL injection vulnerability exists in Plesk Obsidian up to 18.0.80 for Linux and Windows, which allows an authenticated user to read arbitrary data from the underlying panel database. The vulnerability poses significant risk to the confidentiality of sensitive stored data within the application database. Exploitation of this security flaw requires authentication to the application interface, granting the attacker the capability to execute arbitrary SQL commands via vulnerable input vectors. Successful exploitation compromises database integrity and data privacy, potentially exposing administrative credentials, user details, and critical system configurations managed by the Plesk Obsidian panel.",
  "technicalDetails": "The root cause of this vulnerability stems from improper neutralization of user-supplied input prior to its inclusion in dynamic SQL queries executed against the panel database. Specifically, input parameters processed by the application fail to undergo adequate sanitization, parameterized querying, or strong typing, allowing malicious SQL commands to be injected directly into database query structures.\nThe affected component is the database interaction layer of Plesk Obsidian up to 18.0.80 for Linux and Windows. To exploit this vulnerability, an attacker must first obtain valid user credentials to achieve authentication within the system. The requirement for authentication limits unauthenticated attack vectors, but insider threats or compromised low-privileged accounts can leverage this flaw for privilege escalation and data harvesting.\nThe attack flow proceeds as follows: First, the authenticated user crafts a specialized HTTP request containing malicious SQL payload syntax targeting vulnerable input fields within the application interface. Second, the Plesk Obsidian backend ingests this unvalidated input and improperly concatenates it directly into an SQL statement. Third, the database management system parses and executes the resulting malformed query, interpreting the attacker's input as executable database commands rather than literal data strings.\nBecause the vulnerability facilitates arbitrary data reading from the panel database, the post-exploitation impact includes the unauthorized extraction of sensitive records. An attacker can systematically enumerate database tables, retrieve confidential application state information, extract password hashes, and harvest session identifiers or cryptographic secrets stored persistently within the database, severely compromising the overall security posture of the hosting environment."
}