Vulnerability · Published Sep 23, 2026 · Assigned by cisa-cg

CVE-2026-96651Plex Media Server path traversal

Medium 6.5

In plain English

A medium-severity path traversal in Media Server from Plex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 42.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

Affected products (as reported)

Vendor	Product	Versions
Plex	Media Server	0 – before 1.43.3.10861

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

url third-party-advisory
url vdb-entry
url release-notes
url third-party-advisory