Plex Media Server External Control of File Name or Path Vulnerability
Plex — Media Server
- Added to KEV catalog
- 20 October 2026
- Federal remediation due date
- 23 October 2026
- Weakness classification (CWE)
- CWE-73
AI Breakdown
What it is
Plex Media Server versions prior to 1.43.3.10861 contain an improper path control vulnerability that allows an administrative user to write arbitrary files to the system. By injecting settings via transcoder options, an attacker can place malicious shared library files that the server automatically executes on startup without security checks. This vulnerability can also be chained with other related flaws to achieve full system execution.
Why it matters
CISA has confirmed that this vulnerability is being actively exploited in the wild, posing an immediate risk to affected environments. While ransomware campaign use is currently unknown, unauthorized code execution at this level can lead to complete host takeover. The severity is heightened if administrative interfaces are exposed to untrusted networks or chained with other exploits.
Recommended action
IT teams should immediately apply mitigations according to vendor instructions, such as upgrading Plex Media Server to version 1.43.3.10861 or higher. Organizations must evaluate internet exposure, conduct forensics triage if necessary, and ensure compliance with risk-based patching guidelines. If effective mitigations are unavailable, discontinue use of the product immediately.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96656
NVD Technical Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
More Plex Vulnerabilities
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Remote Code Execution Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services