Plex Media Server External Control of File Name or Path Vulnerability

🚨SEVERITY: HIGH — CVSS 7.2Security Advisory

TL;DR 📌

  • Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
  • Highest CVSS: 7.2 (High).
  • Listed in CISA KEV (2026-10-20) — this is being exploited in the wild.
  • Fixed in 1.43.0.10861 — upgrade to this release or later.
  • CVEs: CVE-2026-96656.

What it is

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

For leadership 🧭

Executive summary. Risk is High (CVSS 7.2) across any Plex kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source