CVE-2026-96655: Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Plex Media Server. The flaw can be exploited remotely over the network and does not require user interaction.
Which deployments are affected?
Plex Media Server versions before 1.43.3.10861 are affected. The available information does not state whether any particular default configuration or exposure setting is required.
What can an attacker do with successful exploitation?
An authenticated attacker can cause the server to send requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. The stated impact is limited to confidentiality; no integrity or availability impact is specified.