high · CVSS v3 6.5 · CVSS v4 7.1
CVE-2026-96651
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, a…
Description
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
Scores
- Severity
- high
- CVSS v2
- 5
- CVSS v3
- 6.5
- CVSS v4
- 7.1
- EPSS
- —