Skip to content

Product

Plex Media Server vulnerabilities

20 published CVES affecting Plex Media Server, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
20
Critical
1
High
12
Medium
7
Low
0
Unscored
0
CISA KEV
5

Latest Plex Media Server CVEs

Newest publication first

  1. CVE-2026-96656 Plex Media Server arbitrary file write

    Published
    HighCVSS 8.6 EPSS 1.8% CISA KEV added 2026-10-20 Exploited in the wild

    Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit...

  2. CVE-2026-96655 Plex Media Server arbitrary-host SSRF

    Published
    MediumCVSS 5.3 EPSS 10.7% CISA KEV added 2026-10-20 Exploited in the wild

    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

  3. CVE-2026-96654 Plex Media Server URL injection

    Published
    MediumCVSS 6.9 EPSS 1.9% CISA KEV added 2026-10-20 Exploited in the wild

    Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

  4. CVE-2026-96652 Plex Media Server SSRF

    Published
    MediumCVSS 5.3 EPSS 11.9% CISA KEV added 2026-10-20 Exploited in the wild

    Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

  5. CVE-2026-96651 Plex Media Server path traversal

    Published
    HighCVSS 7.1

    Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This ac...

  10. CVE-2025-34158 Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /...

    Published
    HighCVSS 8.5

    Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).

  12. CVE-2021-42835 An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the upda...

    Published
    HighCVSS 7.0

    An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact wit...

  16. CVE-2019-19141 The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This....

    Published
    HighCVSS 8.8

    The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubu...

  17. CVE-2018-21031 Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initi...

    Published
    MediumCVSS 6.5

    Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the...

  18. CVE-2018-13415 In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vul...

    Published
    CriticalCVSS 9.8 Public exploit

    In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same perm...

  19. CVE-2014-9304 Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers....

    Published
    HighCVSS 7.5 EPSS 8.1%

    Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in th...

  20. CVE-2014-9181 Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authe...

    Published
    MediumCVSS 5.0 EPSS 9.5%

    Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resource...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.