CVE-2026-96654

Analyzed Analyzed - Analysis Complete

Plex Media Server Plugin Function Parameter Injection

Publication date: 2026-09-23

Last updated on: 2026-09-29

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-29

Generated

2026-10-14

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-96654

EUVD

EUVD-2026-85368

Affected Vendors & Products

Vendor	Product	Version / Range
plex	media_server	to 1.43.0.10861 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-84	The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Attack-Flow Graph

Executive Summary

Plex Media Server before version 1.43.3.10861 fails to properly neutralize URL values in the 'searchOne' parameter. This allows an attacker to inject malicious URLs that can call functions from other plugins and supply their own parameters, potentially leading to unauthorized actions.

Detection Guidance

The vulnerability involves improper neutralization of URL values in the 'searchOne' parameter of Plex Media Server versions before 1.43.3.10861. To detect it, check if your Plex Media Server version is below 1.43.3.10861. If so, the system is vulnerable. Update to the latest version immediately.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your Plex Media Server, such as accessing sensitive data, modifying settings, or chaining further attacks. The impact depends on the plugins installed and their permissions.

Compliance Impact

The vulnerability allows unauthorized parameter injection via URL manipulation, which could lead to unauthorized access or data exfiltration. This may violate GDPR's data protection requirements if personal data is exposed, and HIPAA's integrity and confidentiality rules if patient data is compromised. The lack of proper input neutralization increases the risk of non-compliance with these standards.

Mitigation Strategies

Update Plex Media Server to version 1.43.3.10861 or later to address the vulnerability.
Monitor network traffic for unusual plugin function calls or URL parameters in the 'searchOne' field.
Restrict access to Plex Media Server interfaces to trusted networks or users.

Hi! I’m here to help you understand CVE-2026-96654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70