CVE-2026-96654

Plex Media Server URL injection

medium · 6.9

Known exploited

Fix listed

Plex Media Server

Published Sep 23, 2026, 16:06 UTC

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Reported fixed versions

1.43.3.10861

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.