Unauth RCE chain for Plex Media Server <= 1.43.3.10828. Fixed in 1.43.3.10861. Update ASAP.
CVSS 3.1: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Write-up: https://zmain.info/blog/plex2shell
This tool is published for authorized security testing, academic research, and defensive purposes only. Use it only against systems you own or have explicit written permission to test. The authors are not responsible for misuse or damage caused by this tool. Unauthorized access to computer systems is illegal.
| CVE | Primitive |
|---|---|
| CVE-2026-96652 | Unauthenticated SSRF via /player/timeline protocol= |
| CVE-2026-96654 | Loopback pivot: dead auth guard + searchOne identifier= injection |
| CVE-2026-96655 | Owner-authed transcoder SSRF + arbitrary-path file write (dump-yuv) |
| CVE-2026-96656 | Code execution via unsigned codec dlopen in the Codecs set-dir |
- Python 3.8+,
ffmpeg,gcc(orx86_64-w64-mingw32-gccfor Windows targets) - Attacker host reachable from the target (media fetch + reverse shell)
GPLv3