Plex Media Server
Advisory ansehen veröffentlicht 2026-09-23
Plex Media Server before 1.43.3.10861 contains multiple vulnerabilities. In the worst case, a remote attacker could steal a legitimate user's account credentials and eventually write arbitrary files or execute code.
01
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-96656US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264'… | ||||
| CVE-2026-96655US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | ||||
| CVE-2026-96654US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own p… | ||||
| CVE-2026-96652US | —OT kritisch | KEV | ||
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the… | ||||
| CVE-2026-96651US | — | — | ||
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A rem… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (5)
- BehobenMedia Server
Fixed in 1.43.3.10861.
- BehobenMedia Server
Fixed in 1.43.3.10861.
- BehobenMedia Server
Fixed in 1.43.3.10861.
- BehobenMedia Server
Fixed in 1.43.3.10861.
- BehobenMedia Server
Fixed in 1.43.3.10861.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan