CVE-2020-5741

Plex Media Server Remote Code Execution Vulnerability

Plex — Media Server

Added to KEV catalog: 10 March 2023
Federal remediation due date: 31 March 2023
Weakness classification (CWE): CWE-502

CISA Description

Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.

Required action

Apply updates per vendor instructions.

Notes

https://forums.plex.tv/t/security-regarding-cve-2020-5741/586819; https://nvd.nist.gov/vuln/detail/CVE-2020-5741

View on NVD View on MITRE CVE View full CISA catalog

More Plex Vulnerabilities

CVE-2026-96652

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

CVE-2026-96656

Plex Media Server External Control of File Name or Path Vulnerability

CVE-2026-96654

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

CVE-2026-96655

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services