CVE-2026-96655

Plex Media Server arbitrary-host SSRF

medium · 4.3

Known exploited

Fix listed

Plex Media Server

Published Sep 23, 2026, 16:06 UTC

Description

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

Reported fixed versions

1.43.3.10861

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.