CVE-2026-96651: Plex Media Server path traversal
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A remote attacker needs a valid Plex session token. An attacker on the local network may also be able to exploit it by supplying an X-Forwarded-For header.
What is the impact if exploitation succeeds?
An attacker can read files that are accessible to the user running Plex Media Server. This may include the PlexOnlineToken, which can grant control of the Plex account and server.
Which versions are affected?
Plex Media Server versions before 1.43.3.10861 are affected.