Vulnerability Description
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Plex | Media Server | < 1.43.0.10861 |
Related Weaknesses (CWE)
References
- https://forums.plex.tv/t/plex-media-server/30447/711Release Notes
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-96654Third Party AdvisoryVDB Entry
- https://zmain.info/blog/plex2shellThird Party Advisory
FAQ
What is CVE-2026-96654?
CVE-2026-96654 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
How severe is CVE-2026-96654?
CVE-2026-96654 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-96654?
Check the references section above for vendor advisories and patch information. Affected products include: Plex Media Server.