Vulnerability Details CVE-2026-96651
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 42.4%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-96651
-
cpe:2.3:a:plex:media_server:-
-
cpe:2.3:a:plex:media_server:0.9.9.2
-
cpe:2.3:a:plex:media_server:1.13.2.5154
-
cpe:2.3:a:plex:media_server:1.18.2.2029
-
cpe:2.3:a:plex:media_server:1.18.2.2029-36236cc4c
-
cpe:2.3:a:plex:media_server:1.19.1.2701
-
cpe:2.3:a:plex:media_server:1.19.3
-
cpe:2.3:a:plex:media_server:1.21
-
cpe:2.3:a:plex:media_server:1.24.4.5081
-
cpe:2.3:a:plex:media_server:1.25.0.5282
-
cpe:2.3:a:plex:media_server:1.42.0.9975
-
cpe:2.3:a:plex:media_server:1.42.1.10054
-
cpe:2.3:a:plex:media_server:1.42.1.10060
-
cpe:2.3:a:plex:media_server:1.42.2.10122
-
cpe:2.3:a:plex:media_server:1.42.2.10156
-
cpe:2.3:a:plex:media_server:1.43.0.10162
-
cpe:2.3:a:plex:media_server:1.43.0.10231
-
cpe:2.3:a:plex:media_server:1.43.0.10346
-
cpe:2.3:a:plex:media_server:1.43.0.10389
-
cpe:2.3:a:plex:media_server:1.43.0.10467
-
cpe:2.3:a:plex:media_server:1.43.0.10492