DEV Community

kozhevniko
kozhevniko

Posted on

Plex searchOne URL injection: chaining an unauthenticated entry point into plugin calls

#cybersecurity #infosec #security

Plex searchOne URL injection: chaining an unauthenticated entry point into plugin calls

CVE-2026-96654 sits one step away from the SSRF family in the same Plex Media Server patch. Its CNA description is short: the server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne, which allows an attacker to call other plugins' functions and supply their own parameters. The phrase about other plugins deserves a second look.

Vulnerability overview

The CNA classifies the issue as CWE-84, improper neutralization of encoded URI schemes in a web page, with CVSS v3.1 base score 6.5 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. CVSS v4.0 is 6.9. Every privilege and interaction field points at an unauthenticated, remote entry point: no privileges required, no user interaction, network attack vector. CISA's SSVC entry records Exploitation as none and Automatable as yes.

Mechanism and exploitation conditions

searchOne is a search endpoint that accepts a URL for a provider and passes it along to plugin code. When the value is not checked against an allowlist of schemes and hosts, a crafted value reaches the plugin dispatcher with parameters the caller controls. The record's wording about calling other plugins' functions means the attacker is not limited to the plugin they addressed. Successful exploitation needs only a reachable HTTP interface and a request that survives whatever parsing the endpoint performs.

Impact

Confidentiality and integrity are both rated low, with no availability impact. The practical shape is an attacker who can invoke plugin functionality that was not meant to be reachable from the search path, which can disclose metadata the plugin had access to or alter state the plugin manages. Automatic exploitability raises the value of getting the patch in place quickly.

Affected products and scope

Plex Media Server builds below 1.43.3.10861 are affected, and the fix version is the same boundary used by the other three identifiers in this set. The scope depends on which plugins are installed, since the flaw exposes plugin functions rather than a fixed internal service.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matches when this article was prepared, describing the spread of the product rather than the number of vulnerable installs. A CVE-specific filter for CVE-2026-96652 returned no matches; the same limitation applies to a query aimed at this identifier, so treat product counts as context only.

Remediation and mitigations

Update to 1.43.3.10861 or later. Where that is not immediate, remove or disable plugins that are not in use, since each plugin adds functions an injected call might reach, and put a proxy rule in place that rejects search requests carrying absolute URLs. After the upgrade, compare plugin inventories against what the server actually needs.

References

  1. CVE-2026-96654, https://www.cve.org/CVERecord?id=CVE-2026-96654
  2. CVE-2026-96652, https://www.cve.org/CVERecord?id=CVE-2026-96652
  3. CISA CSAF advisory va-26-266-01, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  4. Plex release notes, https://forums.plex.tv/t/plex-media-server/30447/711

Top comments (0)