SB2026102036 - Multiple vulnerabilities in Plex Media Server
Published: October 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-96652) Exploited
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input within /player/timeline. A remote user can include a full URL in the "protocol" parameter and force the Plex server to POST to the attacker's chosen destination
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
2) Improper Neutralization of Encoded URI Schemes in a Web Page (CVE-ID: CVE-2026-96654) Exploited
CWE-ID: CWE-84 - Improper Neutralization of Encoded URI Schemes in a Web Page
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected application does not correctly neutralize URL values included in "searchOne". A remote attacker can call other plugins' functions and supply their own parameters.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-96655) Exploited
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in the "/video/:/transcode/universal" path parameter. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
4) External Control of File Name or Path (CVE-ID: CVE-2026-96656) Exploited
CWE-ID: CWE-73 - External Control of File Name or Path
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to application allows an attacker to control path of the files to delete. A remote administrator can write arbitrary files that may be executed on load, leading to arbitrary code execution.
Remediation
Install update from vendor's website.