AI description
CVE-2026-96652 is an unauthenticated server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw exists within the `/player/timeline` endpoint, where the application fails to validate the `protocol` parameter before inserting it into a programmatically-constructed player URL. By supplying any `X-Plex-Token` value and including a full URL in the `protocol` parameter, an attacker can force the Plex server to send a POST request to an arbitrary destination of their choice. This vulnerability is part of a chain of four flaws collectively known as "Plex2Shell". When chained together, these vulnerabilities allow attackers to achieve unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit, threat actors have actively targeted unpatched servers to deploy cryptocurrency miners and proxy software. Plex addressed the vulnerability in version 1.43.3.10861, which was released in August 2026.
- Description
- Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
- NVD status
- Analyzed
- Products
- media_server
CVSS 4.0
- Type
- Secondary
- Base score
- 5.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.1
- Type
- Secondary
- Base score
- 4.3
- Impact score
- 1.4
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
- 9119a7d8-5eab-497f-8521-727c672e3725
- CWE-918
- Hype score
- Not currently trending
🔴 Plex flaws chained for RCE; in-the-wild attacks deploying cryptominers Four CVEs in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) disclosed October 16 are being actively exploited. A researcher chained multiple vulnerabilities to achieve
@NewsTongueX
19 Oct 2026
64 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Plex Media Server let remote attackers fetch and run Linux ELF payloads with no credentials by chaining four CVEs. CVE-2026-96652 opened unauthenticated SSRF on /player/timeline by accepting an arbitrary protocol parameter. CVE-2026-96654 then let the attacker invoke internal
@SecureChap
19 Oct 2026
73 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Plex Media ServerのPlex4Shell脆弱性が悪用された。ハニーポット観測。4件の脆弱性(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)を連鎖させることで無認証で遠隔コード実行可能。 https://t.co/1XTiRaNDX4
@__kokumoto
19 Oct 2026
1088 Impressions
1 Retweet
5 Likes
3 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48C79D09-D197-4165-B027-8BCCE6CD4861",
"versionEndExcluding": "1.43.0.10861",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]