Plex Media Server < 1.43.3.10861 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367771);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-96651",
    "CVE-2026-96652",
    "CVE-2026-96654",
    "CVE-2026-96655",
    "CVE-2026-96656"
  );

  script_name(english:"Plex Media Server < 1.43.3.10861 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The media server software installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Plex Media Server installed on the remote host is prior to 1.43.3.10861.
It is, therefore, affected by multiple vulnerabilities:

  - Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.
    The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup,
    all .so files are run without signature, execute bit, or symbol checks. (CVE-2026-96656)

  - Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../
    sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token
    could read any file that the target user can access. This access includes the PlexOnlineToken, which grants
    control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could
    exploit the same issue. (CVE-2026-96651)

  - Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an
    attacker to call other plugins' functions and supply their own parameters. (CVE-2026-96654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0667d0f8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Plex Media Server version 1.43.3.10861 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-96656");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plex:media_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("plex_media_server_installed_linux.nbin", "macosx_plex_media_server_installed.nbin", "plex_win_installed.nbin", "plex_detect.nbin");
  script_require_keys("installed_sw/Plex Media Server");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Plex Media Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
          { 'fixed_version' : '1.43.3.10861' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);