CVE-2026-96654

EUVD-2026-85368
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 80.34%
Affected Products (NVD)
VendorProductVersion
plexmedia_server
𝑥
< 1.43.3.10861
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://forums.plex.tv/t/plex-media-server/30447/711
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
https://www.cve.org/CVERecord?id=CVE-2026-96654
https://zmain.info/blog/plex2shell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654