DEV Community

yutianle
yutianle

Posted on

Four Plex Media Server flaws and what their CVSS vectors say about patch order

#cybersecurity #infosec #security

Four Plex Media Server flaws and what their CVSS vectors say about patch order

Plex Media Server before 1.43.3.10861 is affected by a set of four related flaws that the CNA published separately: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The identifiers are not four copies of one bug. Each record names a different endpoint or subsystem and each carries its own severity, which gives administrators a defensible order for patching even when all four share a single fixed version.

Vulnerability overview

CVE-2026-96652 is a SSRF in the timeline handler with CVSS v3.1 score 4.3. CVE-2026-96654 is a URL injection problem in searchOne with score 6.5 and CWE-84. CVE-2026-96655 is an arbitrary-host SSRF through the /video/:/transcode/universal path parameter with score 4.3. CVE-2026-96656 is an arbitrary file write involving TranscoderH264Options with score 7.2 and CWE-73.

Mechanism and exploitation conditions

The timeline issue lets an attacker put a complete URL into the protocol parameter and make the server POST to that destination using any X-Plex-Token value. The searchOne issue fails to neutralize URL values, which the record says allows calling other plugins' functions with attacker-supplied parameters; its vector lists no privileges required, so the entry point is unauthenticated. The transcode issue accepts arbitrary internal or external addresses in a path parameter for authenticated users. The file write issue requires an admin-level account and appends the TranscoderH264Options preference verbatim to the x264 option string on every transcode.

Impact

Confidentiality is the main loss in the two SSRF records, both with C:L and no integrity or availability impact. The URL injection record adds low integrity impact. The file write record is the heaviest of the four at C:H/I:H/A:H, because the description says written files may be executed on load: at startup the server runs .so files without signature, execute-bit or symbol checks. That is the difference between reading internal responses and running code in the server's context.

Affected products and scope

All four records cover Plex Media Server below 1.43.3.10861 and mark that build unaffected. The privileges required differ sharply: none for CVE-2026-96654, low for CVE-2026-96652 and CVE-2026-96655, high for CVE-2026-96656. The unauthenticated entry point deserves attention even where the admin-only flaw has the higher score.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets during preparation, which shows how widely the product is deployed on reachable addresses. The same data does not tell you which of those servers run a build below the fixed version, and the CVE filter for CVE-2026-96652 returned no matches. Exposure figures describe the product surface, not the population of vulnerable hosts.

Remediation and mitigations

Move to 1.43.3.10861 or later, which resolves all four identifiers. While scheduling the upgrade, reduce reachability of the server's HTTP interface and of the transcode endpoint, and cut down on accounts with admin rights, since the file write path depends on that level of access. After the upgrade, check the transcode preferences for unexpected values and confirm that no unsigned shared objects sit in the plugin directories.

References

  1. CVE-2026-96652, https://www.cve.org/CVERecord?id=CVE-2026-96652
  2. CVE-2026-96654, https://www.cve.org/CVERecord?id=CVE-2026-96654
  3. CVE-2026-96655, https://www.cve.org/CVERecord?id=CVE-2026-96655
  4. CVE-2026-96656, https://www.cve.org/CVERecord?id=CVE-2026-96656
  5. CISA CSAF advisory va-26-266-01, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

Top comments (0)