Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

CVE-2021-33959

CVE-2021-33959 It can be seen that Plex service listens to the four udp ports 32410, 32412, 32413 and 32414. Through the analysis of the attack payload and using the message format of the device query request for reference, we write software to send udp packets with the attack payload of M-SEARCH...

PlEXcalaison

Local Privilege PlEXcalasion - CVE-2021-42835 Plex Media Server for Windows prior to version 1.25.0.5282, vulnerable to Time Of Check Time Of Use TOCTOU that allows low privilege users to gain SYSTEM privileges. Discovered by Tomer Peled, Netanel Cohen, and Amir Shen a Security Researchers from...

Plex Media Server 1.43.3.10828 Timeline Server-Side Request Forgery

Plex Media Server versions before 1.43.3.10861 contain a server-side request forgery vulnerability via the /player/timeline endpoint. The supplied proof of concept demonstrates server-originated requests using an invalid X-Plex-Token value. https://packetstorm.news/download/237300...

Exploit for Server-Side Request Forgery in Plex Media_Server

CVE-2026-96652 — Plex Media Server timeline SSRF PoC and veri...

Exploit for Server-Side Request Forgery in Plex Media_Server

plex2shell-windows-hunt Threat intel and a read-only Windows/...

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below -...

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery SSRF Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a...

Exploit for Server-Side Request Forgery in Plex Media_Server

plex2shell-check Read-only compromise check for Plex2Shell...

Plex Media Server < 1.43.3.10861 Multiple Vulnerabilities

According to its self-reported version, the Plex Media Server installed on the remote host is prior to 1.43.3.10861. It is, therefore, affected by multiple vulnerabilities: - Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The...

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655...

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656...

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery SSRF vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with...

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery SSRF vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and...

plex2shell_pcap

plex2shellpcap pcap artifacts for plex2shell exploitation As of Oct 17th, 2026, this is being exploited in the wild but pcaps with name containing "lab" are from lab testing!! regarding in the wild exploitation: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html...

plex2shell

plex2shell Unauth RCE chain for Plex Media Server 1.43.3.10828. Fixed in 1.43.3.10861. Update ASAP. CVSS 3.1: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Write-up: https://zmain.info/blog/plex2shell Disclaimer This tool is published for authorized security testing, academic research, and defensive...

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept PoC went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involve...

Exploit for External Control of File Name or Path in Plex Media_Server

Unsigned .so planted in Plex Media Server's codec cache exec...

VulnCheck KEV: CVE-2026-96654

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

VulnCheck KEV: CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...