Detections
Analytics

Plex Media Server < 1.43.3.10861 Multiple Vulnerabilities

high Nessus Plugin ID 367771

Synopsis

The media server software installed on the remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version, the Plex Media Server installed on the remote host is prior to 1.43.3.10861.
It is, therefore, affected by multiple vulnerabilities:

 - Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.
 The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. (CVE-2026-96656)

 - Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue. (CVE-2026-96651)

 - Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. (CVE-2026-96654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Plex Media Server version 1.43.3.10861 or later.

See Also

http://www.nessus.org/u?0667d0f8

Plugin Details

Severity: High

ID: 367771

File Name: plex_1_43_3_10861.nasl

Version: 1.1

Type: Combined

Family: Misc.

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.72

CVSS v2

Risk Factor: High

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-96656

CVSS v3

Risk Factor: High

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:plex:media_server

Required KB Items: installed_sw/Plex Media Server

Patch Publication Date: 9/1/2026

Vulnerability Publication Date: 9/1/2026

Reference Information

CVE: CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656