CVE-2026-96651highCWE-22

CVE-2026-96651: falha de alta gravidade em Plex Media Server

Plex Media Server path traversal

Publicada em

Seguir esta CVE+ Monitorar Media Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.8%
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Plex · Media Server
CVEs relacionadas — Plex Media Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-96652MEDIUMPlex Media Server SSRFEPSS 11.9%KEVCVE-2026-96655MEDIUMPlex Media Server arbitrary-host SSRFEPSS 10.7%KEVCVE-2026-96654MEDIUMPlex Media Server URL injectionEPSS 1.9%KEVCVE-2026-96656HIGHPlex Media Server arbitrary file writeEPSS 1.8%KEVCVE-2025-34158HIGHCVE-2025-34158EPSS 0.6%CVE-2025-69415HIGHCVE-2025-69415EPSS 0.3%