CVE-2026-96652

EUVD-2026-85367
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 96.13%
Affected Products (NVD)
VendorProductVersion
plexmedia_server
𝑥
< 1.43.3.10861
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://forums.plex.tv/t/plex-media-server/30447/711
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
https://www.cve.org/CVERecord?id=CVE-2026-96652
https://zmain.info/blog/plex2shell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652