CVE-2026-96651

Katalog CVE

CVSS 6.5 · Medium EPSS 0,52%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada plex media server. Skor CVSS 3.1 6.5 (Medium) menurut CNA.

Deskripsi (NVD)

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2026-96651 advisory pihak ketiga · vdb entry
• https://zmain.info/blog/plex2shell advisory pihak ketiga
• https://forums.plex.tv/t/plex-media-server/30447/711 release notes