Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)

Plex Media Server 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value. id:...

Exploit for Server-Side Request Forgery in Plex Media_Server

CVE-2026-96652 — Plex Media Server timeline SSRF PoC and veri...

VulnCheck KEV: CVE-2026-96652

Plex Media Server contains a server-side request forgery SSRF vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with...

CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

EUVD-2026-85367

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via the /player/timeline endpoint. An attacker can provide any X-Plex-Token value and include a full URL in the protocol parameter, forcing the server to perform a POST request...

PT-2026-97403

Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.43.3.10861 Description A Server-Side Request Forgery SSRF issue exists where an attacker using any X-Plex-Token value can force the server to send a POST request to an arbitrary destination. This is achiev...

CVE-2026-96652: Server-Side Request Forgery (SSRF)

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

Plex Media Server server-side request forgeing vulnerability

Versions of Plex Media Server prior to 1.43.3.10861 have a vulnerability related to server-side request forgery. This vulnerability stems from the /player/timeline path, where server-side request forgery occurs. Attackers can use any valid X-Plex-Token value to include the full URL as a protocol...