Plex Media Server arbitrary file write (Plex Media Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.79 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisa-cg
- NVD status
- Analyzed
Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Weaknesses (CWE)
- CWE-73 — External Control of File Name or Path
References
- https://forums.plex.tv/t/plex-media-server/30447/711
- https://www.cve.org/CVERecord?id=CVE-2026-96656
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
- https://zmain.info/blog/plex2shell
- https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | cisa-cg |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | cisa-cg |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary) |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-85370
- GCVE · GCVE-0-2026-96656
Affected configurations (NVD CPE)
cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*< 1.43.3.10861
Affected products
| Product | Versions |
|---|---|
| Plex · Media Server | affected 0 < 1.43.3.10861 ; unaffected 1.43.3.10861 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |