DEV Community

andreagomez
andreagomez

Posted on

How the four Plex CVEs relate: three request flaws and one path to code execution

#cybersecurity #infosec #security

How the four Plex CVEs relate: three request flaws and one path to code execution

CVE-2026-96652 is one of four identifiers CISA's CSAF guidance groups under Plex Media Server. Reading them together explains why a single upgrade fixes a set of problems that look unrelated at first: three of them abuse a request the server trusts, and the fourth turns an administrative preference into loaded code.

Vulnerability overview

The set contains four identifiers: CVE-2026-96652 (timeline SSRF, v3.1 4.3), CVE-2026-96654 (searchOne URL injection, v3.1 6.5), CVE-2026-96655 (transcode arbitrary-host SSRF, v3.1 4.3) and CVE-2026-96656 (TranscoderH264Options arbitrary file write, v3.1 7.2). All four list Plex Media Server versions below 1.43.3.10861 as affected and 1.43.3.10861 as unaffected.

Mechanism and exploitation conditions

The three request flaws share a pattern: a value that should name a scheme, a plugin or a local path is accepted from the network and used to build a request. Their prerequisites differ. CVE-2026-96654 needs no credentials at all, CVE-2026-96652 and CVE-2026-96655 need a token or an account, and CVE-2026-96656 needs admin rights because it modifies a transcode preference that reaches the x264 command line and can write files the server later loads.

Impact

Confidentiality loss is the common thread in the request flaws, with low integrity impact in the URL injection case. The file write flaw is the outlier with all three impacts high, and CISA's SSVC assessment lists Technical Impact as total for it while the others sit at partial. An attacker who already holds an admin account has the most direct route to code execution in the set.

Affected products and scope

One product version boundary covers all four identifiers. Organisations that treated the earlier SSRF as low priority should note that the same release also closes an unauthenticated entry point and an admin-controlled write.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets during preparation. That figure shows how much of the product faces the internet and not how many instances remain unpatched. The CVE filter for CVE-2026-96652 returned no matches, so indexed CVE counts cannot stand in for version inventory here.

Remediation and mitigations

Upgrade to 1.43.3.10861 or later and verify the running version afterwards. While planning the change, restrict the search and timeline endpoints to trusted networks, reduce admin accounts, and watch for new shared objects in the plugin directories, which is the observable step of the file write chain.

References

  1. CVE-2026-96652, https://www.cve.org/CVERecord?id=CVE-2026-96652
  2. CVE-2026-96654, https://www.cve.org/CVERecord?id=CVE-2026-96654
  3. CVE-2026-96655, https://www.cve.org/CVERecord?id=CVE-2026-96655
  4. CVE-2026-96656, https://www.cve.org/CVERecord?id=CVE-2026-96656
  5. CISA CSAF advisory va-26-266-01, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

Top comments (0)