Skip to content
OpenAdvisories
Medium · 4.3 Known exploited Scanner template Public exploit CVE-2026-96652 EUVD-2026-85367GHSA-5p7w-r379-3c2m

Plex Media Server SSRF

Published Sep 23, 2026 · Updated Oct 21, 2026 · Assigned by cisa-cg

Vendor: Plex Product: Media Server

Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Affected products

VendorProductAffectedFixed
Plex Media Server < 1.43.3.10861 1.43.3.10861

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 8 repositories

  • code-zm/plex2shell ★ 107 · Oct 18, 2026

    CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

  • ChrisLPJones/plex2shell-check ★ 2 · Oct 20, 2026

    Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild

  • gmh5225/plex2shell ★ 1 · Oct 17, 2026

    CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

  • SHIFox8/plex2shell-audit ★ 0 · Nov 10, 2026

    Read-only audit tool for the actively-exploited Plex2Shell exploit chain (CVE-2026-96652/-96654/-96655/-96656, fixed in Plex Media Server 1.43.3.10861). Remote version check + local IoC scan. Stdlib-…

  • akaihigurashi/plex2scan ★ 0 · Oct 27, 2026

    Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more)

  • TheGlitchFixer/plex2shell-check ★ 0 · Oct 24, 2026

    Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?

  • basesixtythree/B63-POC-CVE-2026-96652 ★ 0 · Oct 22, 2026

    PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)

  • w116tjb/plex2shell-windows-hunt ★ 0 · Oct 21, 2026

    Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 1

References

  • url third-party-advisory
  • url release-notes
  • url vdb-entry
  • url third-party-advisory