Plex2Shell
- Product
- Plex Plex Media Server
- CVE
- CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656
- Disclosed
- 2026-10-16
- CVSS
- 4.3
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Plex Media Server 1.43.3.10828 and earlier
- Fixed
- 1.43.3.10861 (released August 2026)
Summary
Researcher Zach Main chained four Plex Media Server bugs into unauthenticated RCE as the plex user on servers exposed on port 32400. He reported them in July and Plex patched them on 4 August 2026, but many servers were still unpatched when details were published on 16 October. Exploitation was reported the next day, installing an XMRig miner and a Linux proxy backdoor. Individually the CVEs score 4.3-7.2 (CNA CVSS v3.1; the primary CVE is 4.3), but the researcher rates the full chain 9.8.
Root cause
/player/timeline only checks that an X-Plex-Token header is present, giving a blind unauthenticated SSRF from 127.0.0.1 (CVE-2026-96652). Loopback requests skip auth on the agent API, and an unsanitized searchOne identifier lets the attacker call arbitrary plugin functions (CVE-2026-96654); GetResultFromNetwork then attaches the owner's token to any URL starting with http://127.0.0.1, which an sslip.io hostname satisfies, leaking it to the attacker. With owner rights, the transcoder fetches attacker media (SSRF) and the TranscoderH264Options preference passes x264 dump-yuv to write an attacker ELF into the Codecs directory (CVE-2026-96655), which the transcoder dlopen()s without any signature check (CVE-2026-96656).
Impact
Unauthenticated code execution as the Plex service account on internet-facing media servers; observed delivering XMRig and a Linux proxy backdoor.
Detection
Check the PMS version in Settings or /identity; look for unexpected files in the Codecs directory, changed transcoder preferences, and odd /player/timeline or loopback-originated agent requests. The researcher's repo includes detection material.
Mitigation
Update to 1.43.3.10861 or later and avoid exposing port 32400 directly; audit Codecs directories and rotate the owner's Plex token.