Plex Media Server SSRF

Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Affected Products

Vendor	Product	Versions
plex	media server	0

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json(third-party-advisory)
https://forums.plex.tv/t/plex-media-server/30447/711(release-notes)
https://www.cve.org/CVERecord?id=CVE-2026-96652(vdb-entry)
https://zmain.info/blog/plex2shell(third-party-advisory)

Related News (2 articles)

Tier D

SecurityWeek2h ago

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

→ No new info (linked only)

Tier C

VulDB25d ago

CVE-2026-96652 | Plex Media Server up to 1.42.1 protocol server-side request forgery

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.14.3 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

1.43.3.10861

CWECWE-918

PublishedSep 23, 2026

Trending Score103🔥

Source articles2

Independent2

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes

Plex Media Server SSRF

Description

Affected Products

References

Related News (2 articles)

Discussion (0)

Community Vote

Related CVEs (4)

Pin to Dashboard

Verification

Vulnerability Timeline