What is CVE-2025-66431?

CVE-2025-66431 is a high-severity vulnerability in Plesk, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 7.8/10. Published 2025-12-03.

How severe is CVE-2025-66431?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Plesk

CVE-2025-66431

WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."

EPSS: 0.002 (13.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Plesk — versions 0, 18.0.74

Weakness classification (CWE)

CWE-61 — UNIX Symbolic Link (Symlink) Following

References

cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2025-66431?: CVE-2025-66431 is a high-severity vulnerability in Plesk, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 7.8/10. Published 2025-12-03.
How severe is CVE-2025-66431?: High severity. CVSS v3 base score is 7.8 out of 10.