PT-2026-1848 · Plesk · Plesk Obsidian

Published 2026-01-08 · Updated 2026-01-09 · CVE-2025-65518

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73

Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service (DoS) condition. The issue resides in the get password.php API endpoint, where a specifically crafted request with a malicious payload can cause the web interface to continuously reload, making the service inaccessible to legitimate users. An attacker can exploit this remotely without needing authentication, leading to a persistent disruption of the Plesk Obsidian instance.

Recommendations Plesk Obsidian versions 8.0.1 through 8.0.73: Apply a fix or update to a newer, unaffected version. Plesk Obsidian versions 8.0.1 through 18.0.73: Apply a fix or update to a newer, unaffected version.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-65518

Affected Products

Plesk Obsidian

References · 8

• 🔥 https://github.com/Jainil-89/CVE-2025-65518/blob/main/cve.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65518 · Security Note
• https://t.me/CVEtracker/41756 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009475052069163356 · Twitter Post
• https://twitter.com/CVEnew/status/2009462373548171741 · Twitter Post
• https://docs.plesk.com/release-notes/obsidian/change-log · Note
• http://plesk.com · Note