Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability
Info Listed in CISA KEV
Summary
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Plex:Media Server
Sources
- CISA KEV DATABASE
Original Links
- https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-96656 reference
Timeline
- kev_ingest CISA KEV