CVE-2026-96651: Plex Media Server

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

Affected products

• Plex Media Server: before 1.43.0.10861 (fixed in 1.43.0.10861)

Published 2026-09-23. Last modified 2026-09-29.