Plex

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Plex product.

RSS Feeds for Plex security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Plex products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Plex Sorted by Most Security Vulnerabilities since 2018

Plex Media Server16 vulnerabilities

Plex Media Server Firmware1 vulnerability

Plex Media Server1 vulnerability

Known Exploited Plex Vulnerabilities

The following Plex vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Plex Media Server Remote Code Execution Vulnerability	Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it. CVE-2020-5741 Exploit Probability: 72.9%	March 10, 2023

The vulnerability CVE-2020-5741: Plex Media Server Remote Code Execution Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 9 vulnerabilities in Plex with an average score of 6.2 out of ten. Last year, in 2025 Plex had 2 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 2.26

Year	Vulnerabilities	Average Score
2026	9	6.24
2025	2	8.50
2024	0	0.00
2023	1	7.50
2022	0	0.00
2021	0	0.00
2020	2	8.00
2019	2	0.00
2018	1	9.80

It may take a day or so for new Plex vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Plex Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-96656	Sep 23, 2026	Plex Media Server 1.43.3.10861 - Arbit. File Write via TranscoderH264Options Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.	Media Server
CVE-2026-96655	Sep 23, 2026	Plex Media Server <1.43.3.10861 Authz Addr Req via /video/:/transcode/universal Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.	Media Server
CVE-2026-96654	Sep 23, 2026	Plex Media Server <1.43.3.10861 'searchOne' URL Injection Allows Plugin Calls Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.	Media Server
CVE-2026-96652	Sep 23, 2026	Plex Media Server <1.43.3.10861 SSRF via /player/timeline (X-Plex-Token) Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.	Media Server
CVE-2026-96651	Sep 23, 2026	Plex Media Server <1.43.3.10861 Path Traversal via /system/agents/media/get Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.	Media Server
CVE-2025-69417	Jan 02, 2026	PMS: Non-server Token leaks share tokens via shared_servers In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint.
CVE-2025-69416	Jan 02, 2026	Plex Media Server Token Disclosure via devices.xml In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml.
CVE-2025-69415	Jan 02, 2026	Plex Media Server (PMS) <1.42.2.10156 Device Token Validation Flaw In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account.	Media Server
CVE-2025-69414	Jan 02, 2026	Plex Media Server 1.42.2.10156 Allows Permanent Token Retrieval (CVE-2025-69414) Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.	Media Server
CVE-2025-34158	Aug 21, 2025	Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).	Media Server