VA-26-266-01

Vulnerability from csaf_cisa - Published: 2026-09-23 15:39 - Updated: 2026-09-23 15:39
Summary
Plex Media Server
Notes
Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).
Countries and Areas Deployed: Worldwide
Critical Infrastructure Sectors: Information Technology
Risk Evaluation: Plex Media Server before 1.43.3.10861 contains multiple vulnerabilities. In the worst case, a remote attacker could steal a legitimate user's account credentials and eventually write arbitrary files or execute code.
Recommended Practices: Fixed in Plex Media Server 1.43.3.10861.
Company Headquarters Location: United States
CVE-2026-96651
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
Plex Media Server <1.43.3.10861
Plex / Media Server
 <1.43.3.10861
Vendor Fix
Product Identifier Version Remediation
Plex Media Server 1.43.3.10861
Plex / Media Server
 1.43.3.10861
Vendor Fix
CVE-2026-96652
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Known affected 1 product, the same list as for CVE-2026-96651
Fixed 1 product, the same list as for CVE-2026-96651
CVE-2026-96654
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-84 - Improper Neutralization of Encoded URI Schemes in a Web Page
Affected products
Known affected 1 product, the same list as for CVE-2026-96651
Fixed 1 product, the same list as for CVE-2026-96651
CVE-2026-96655
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-918 - Server-Side Request Forgery (SSRF)
Affected products
Known affected 1 product, the same list as for CVE-2026-96651
Fixed 1 product, the same list as for CVE-2026-96651
CVE-2026-96656
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-73 - External Control of File Name or Path
Affected products
Known affected 1 product, the same list as for CVE-2026-96651
Fixed 1 product, the same list as for CVE-2026-96651
References
Acknowledgments
Zach Main
To clipboard 

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "Plex Media Server before 1.43.3.10861 contains multiple vulnerabilities. In the worst case, a remote attacker could steal a legitimate user\u0027s account credentials and eventually write arbitrary files or execute code.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Fixed in Plex Media Server 1.43.3.10861.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-266-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
      }
    ],
    "title": "Plex Media Server",
    "tracking": {
      "current_release_date": "2026-09-23T15:39:29Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.129"
        }
      },
      "id": "VA-26-266-01",
      "initial_release_date": "2026-09-23T15:39:29Z",
      "revision_history": [
        {
          "date": "2026-09-23T15:39:29Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.43.3.10861",
                "product": {
                  "name": "Plex Media Server \u003c1.43.3.10861",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "1.43.3.10861",
                "product": {
                  "name": "Plex Media Server 1.43.3.10861",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Media Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.43.3.10861",
                "product": {
                  "name": "Plex Media Server \u003c1.43.3.10861",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "1.43.3.10861",
                "product": {
                  "name": "Plex Media Server 1.43.3.10861",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Media Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.43.3.10861",
                "product": {
                  "name": "Plex Media Server \u003c1.43.3.10861",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "1.43.3.10861",
                "product": {
                  "name": "Plex Media Server 1.43.3.10861",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Media Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.43.3.10861",
                "product": {
                  "name": "Plex Media Server \u003c1.43.3.10861",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "1.43.3.10861",
                "product": {
                  "name": "Plex Media Server 1.43.3.10861",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Media Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.43.3.10861",
                "product": {
                  "name": "Plex Media Server \u003c1.43.3.10861",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "1.43.3.10861",
                "product": {
                  "name": "Plex Media Server 1.43.3.10861",
                  "product_id": "CSAFPID-0010"
                }
              }
            ],
            "category": "product_name",
            "name": "Media Server"
          }
        ],
        "category": "vendor",
        "name": "Plex"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Zach Main"
          ]
        }
      ],
      "cve": "CVE-2026-96651",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via \u0027/system/agents/media/get\u0027. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-09-14T18:18:59Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96651"
        },
        {
          "category": "external",
          "summary": "forums.plex.tv",
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "category": "external",
          "summary": "zmain.info",
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "release_date": "2026-08-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Plex Media Server path traversal"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zach Main"
          ]
        }
      ],
      "cve": "CVE-2026-96652",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Plex Media Server before 1.43.3.10861 allows SSRF via \u0027/player/timeline\u0027. An attacker using any X-Plex-Token value can include a full URL in the \u0027protocol\u0027 parameter and force the Plex server to POST to the attacker\u0027s chosen destination.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-09-14T18:19:53Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json "
        },
        {
          "category": "external",
          "summary": "forums.plex.tv",
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96652"
        },
        {
          "category": "external",
          "summary": "zmain.info",
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "release_date": "2026-08-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Plex Media Server SSRF"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zach Main"
          ]
        }
      ],
      "cve": "CVE-2026-96654",
      "cwe": {
        "id": "CWE-84",
        "name": "Improper Neutralization of Encoded URI Schemes in a Web Page"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in \u0027searchOne,\u0027 allowing an attacker to call other plugins\u0027 functions and supply their own parameters.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-09-14T18:22:58Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96654"
        },
        {
          "category": "external",
          "summary": "forums.plex.tv",
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "category": "external",
          "summary": "zmain.info",
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "release_date": "2026-08-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Plex Media Server URL injection"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zach Main"
          ]
        }
      ],
      "cve": "CVE-2026-96655",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the \u0027/video/:/transcode/universal\u0027 path parameter.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-09-14T18:23:48Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "category": "external",
          "summary": "forums.plex.tv",
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96655"
        },
        {
          "category": "external",
          "summary": "zmain.info",
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "release_date": "2026-08-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Plex Media Server arbitrary-host SSRF"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zach Main"
          ]
        }
      ],
      "cve": "CVE-2026-96656",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264\u0027s option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-09-14T18:24:56Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "forums.plex.tv",
          "url": "https://forums.plex.tv/t/plex-media-server/30447/711"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-96656"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
        },
        {
          "category": "external",
          "summary": "zmain.info",
          "url": "https://zmain.info/blog/plex2shell"
        }
      ],
      "release_date": "2026-08-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 1.43.3.10861.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Plex Media Server arbitrary file write"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.