Plex on PhllapsNET

Plex Media Server External Control of File Name or Path Vulnerability

Tue, 20 Oct 2026 00:00:00 +0000

🚨SEVERITY: HIGH — CVSS 7.2Security Advisory

TL;DR 📌

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Highest CVSS: 7.2 (High).
Listed in CISA KEV (2026-10-20) — this is being exploited in the wild.
Fixed in 1.43.0.10861 — upgrade to this release or later.
CVEs: CVE-2026-96656.

What it is

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Tue, 20 Oct 2026 00:00:00 +0000

🚨SEVERITY: MEDIUM — CVSS 6.5Security Advisory

TL;DR 📌

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins’ functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
Highest CVSS: 6.5 (Medium).
Listed in CISA KEV (2026-10-20) — this is being exploited in the wild.
Fixed in 1.43.0.10861 — upgrade to this release or later.
CVEs: CVE-2026-96654.

What it is

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins’ functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Tue, 20 Oct 2026 00:00:00 +0000

🚨SEVERITY: MEDIUM — CVSS 4.3Security Advisory

TL;DR 📌

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the ‘protocol’ parameter and force the Plex server to POST to the attacker’s chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Highest CVSS: 4.3 (Medium).
Listed in CISA KEV (2026-10-20) — this is being exploited in the wild.
Fixed in 1.43.0.10861 — upgrade to this release or later.
CVEs: CVE-2026-96652.

What it is

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the ‘protocol’ parameter and force the Plex server to POST to the attacker’s chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Tue, 20 Oct 2026 00:00:00 +0000

🚨SEVERITY: MEDIUM — CVSS 4.3Security Advisory

TL;DR 📌

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
Highest CVSS: 4.3 (Medium).
Listed in CISA KEV (2026-10-20) — this is being exploited in the wild.
Fixed in 1.43.0.10861 — upgrade to this release or later.
CVEs: CVE-2026-96655.

What it is

Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the ‘/video/:/transcode/universal’ path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.