Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Plex Media Server 1.43.3.10861 Clear all filters
TI-2026-63829 CVE-2026-96656 · GHSA-2g2v-9wf5-6m3g

Arbitrary file write in Plex Media Server enables code execution

Priority CRITICAL 96KEV

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01785 Published 2026-09-23 Fixed in 1.43.3.10861 CWE-73
TI-2026-63828 CVE-2026-96655 · GHSA-9x88-w2p7-56vh

Server-side request forgery in Plex Media Server

Priority HIGH 81KEV

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.10724 Published 2026-09-23 Fixed in 1.43.3.10861 CWE-918
TI-2026-63827 CVE-2026-96654 · GHSA-3j7c-jr86-m5jq

Plex Media Server URL injection lets attackers call other plugins

Priority CRITICAL 88KEV

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01949 Published 2026-09-23 Fixed in 1.43.3.10861 CWE-84
TI-2026-63826 CVE-2026-96652 · GHSA-5p7w-r379-3c2m

Server-side request forgery in Plex Media Server

Priority HIGH 81KEV

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.11886 Published 2026-09-23 Fixed in 1.43.3.10861 CWE-918
TI-2026-63825 CVE-2026-96651 · GHSA-x3g5-jwm4-93w7

Plex Media Server path traversal

Priority LOW 33

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00827 Published 2026-09-23 Fixed in 1.43.3.10861 CWE-22