DEV Community

Ioneyrezende
Ioneyrezende

Posted on

A backup plugin with wrong file permissions turns shared hosting into root

#security

A backup plugin with wrong file permissions turns shared hosting into root

CVE-2026-87886 is a local privilege escalation caused by insecure file permissions in Acronis backup integrations for three hosting control panels. NVD records a CVSS 3.0 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 16 September 2026.

The three products and the exact builds

The affected components are the Acronis Backup plugin for cPanel and WHM on Linux before build 1.9.3.1021, the Acronis Backup extension for Plesk on Linux before build 1.8.11.638, and the Acronis Backup plugin for DirectAdmin on Linux before build 1.2.3.238. Acronis documents the defect as SEC-10986.
The architectural detail that matters is the deployment model. These plugins run on a hosting server whose entire purpose is to let many unprivileged users, each with their own account and their own files, execute code as themselves. A local privilege escalation on that server is not an edge case. It is the threat model the platform exists to contain.

Why local matters on shared hosting

On a laptop, a local privilege escalation requires the attacker to already have a shell. On a shared hosting server, the queue of people who can execute code as a low-privileged user is the customer list.
A hosting account that runs a vulnerable CMS, a plugin, or a personal script is enough for an attacker to land as that user. From there, the pivot to root exposes every other account on the machine, the panel's own configuration, the backup repository credentials, and the backup history itself.
That last item is often overlooked. A backup agent stores credentials to the backup destination in order to upload data. Those credentials may reach a storage account shared across many servers owned by the same hosting provider. Escalation on one node can therefore compromise the integrity of backups that are supposed to protect against exactly this kind of event.

Reading the CVSS vector carefully

AV:L means the attack requires local access, which is why the score sits at 7.8 rather than in the nines. The integrity component is High and the complexity is Low, which tells you the exploitation step is simple once the foothold exists. AC:L and PR:L together describe a well-understood pattern: a writable file that a higher-privileged process trusts.
NVD does not enumerate which paths are affected, and the Acronis advisory is the authoritative source for the fixed builds. Do not attempt to reverse the exact file list from the CVE text; there is nothing there to recover.

Actions for hosting operators

Update the plugin or extension to the fixed build for the panel you run. All three panels have separate release artefacts, so an estate that runs more than one needs more than one update.
Then audit the permissions that made the flaw exploitable in the first place. The general pattern is a file or directory inside customer-writable space that is executed or read by a process running with elevated rights. Any such path on a shared host belongs on a restricted list, and the plugin's own directories should not be writable by the accounts it backs up.
Check whether the panel's backup job runs as root and whether it resolves any path through a customer-controlled location. If it does, the escalation is structural rather than specific to one build.

What evidence looks like after the fact

Root-level compromise on a hosting node does not produce a tidy log entry. The artifacts are more mundane: a process that started as a hosting user and left files owned by root, a cron entry that nobody wrote, an SSH key added to a privileged account, or a panel session that changed permissions outside a maintenance window.
File integrity monitoring on the panel's own directories and on privileged cron locations is the control that would catch this. If you do not have it, enabling it now tells you about the next event rather than this one.
The backup retention question is worth asking in parallel. If an attacker had root on a node that uploads to your backup destination, verify that the retention copies are intact and that nothing was deleted to remove evidence. Immutable backup storage exists for this reason.

The durable lesson

Control panel plugins inherit the privilege of the panel they extend, and the panel extends root. That inheritance is invisible in the product's marketing and often invisible in the operator's change process, because a backup plugin looks like a convenience rather than a privileged component.
CVE-2026-87886 is a fixable permissions bug in three specific builds. The reason it reached the exploited list is that the environments running those builds are, by construction, full of users who can already run code.

References

Top comments (0)