CVE-2026-96651

Executive Summary

CVE-2026-96651 is a path traversal vulnerability in Plex Media Server versions before 1.43.3.10861, caused by improper validation of the url parameter on the /system/agents/media/get endpoint before it is used to build a file path. An authenticated attacker holding a valid session token—or a LAN-adjacent attacker supplying a crafted X-Forwarded-For header—can read arbitrary files accessible to the target user, including the PlexOnlineToken. Disclosure of that token enables full control of the Plex account and the associated server. At CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), exploitation requires low privilege and yields a high confidentiality impact with no integrity or availability loss.

Technical Analysis

CVE-2026-96651 is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal). The root cause described by the NVD is that Plex Media Server "builds a file path from the url parameter without checking it for ../ sequences." This describes a classic traversal condition in which user-controlled input is incorporated into a filesystem path and the resulting path is not canonicalized or confined to an intended base directory before the file is opened.

The affected surface is the /system/agents/media/get endpoint of Plex Media Server. This endpoint accepts a url parameter; per the advisory, the server does not validate that parameter for directory-traversal sequences before constructing the path used for file access. Because there is no check for ../ sequences, an attacker can supply crafted input to escape the intended directory and reference files elsewhere on the host filesystem that the Plex server process (or the target user) is permitted to read.

Two access conditions are described:

1. Authenticated remote access: An attacker possessing a valid session token can invoke the endpoint directly. The CVSS vector reflects this: PR:L (low privilege) and AV:N (network), meaning the attacker needs some low-level authorization but can attack over the network. This is consistent with authentication being a precondition while the traversal check itself remains absent.

2. LAN-adjacent access: The advisory states that a LAN-adjacent attacker can exploit the same issue by supplying an X-Forwarded-For header. This implies that the server's access or trust decision relies in some part on the client-supplied X-Forwarded-For value, which is not trustworthy unless set by a controlled reverse proxy that strips inbound spoofed headers. An attacker on the same local network can therefore present a header value that the server treats as a trusted/local origin, bypassing the intended trust boundary and reaching the vulnerable code path.

The high confidentiality impact (C:H) is justified by the sensitivity of files reachable through traversal. The advisory specifically calls out the PlexOnlineToken, which grants control of the Plex account and the server. That single file disclosure elevates the bug from a generic local-file-read into an account- and server-takeover primitive, because the token is a credential.

The integrity and availability impacts are None (I:N/A:N). The vulnerability is a read primitive only; it does not describe file writes, remote code execution, or denial of service. The scope is Unchanged (S:U): exploitation stays within the security authority of the Plex server process and the user context it runs under.

No public proof-of-concept, exploit code, or Nuclei template was identified in the data provided. The mechanics described here are derived directly from the NVD description and the vulnerability class; no additional implementation details are asserted. Specific request bodies, parameter encodings, or the base directory that is escaped are not disclosed in the source data and are therefore not specified.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class and the details present in the NVD description. Only the endpoint /system/agents/media/get, the url parameter, the ../ traversal sequence, and the X-Forwarded-For header are named in the source and are used here.

1. Reconnaissance / target identification. The attacker locates an internet-reachable or LAN-reachable Plex Media Server. Internet-exposed instances are discoverable via service fingerprinting (Shodan/Censys queries for Plex Media Server). LAN-adjacent attackers identify the server on the local segment. The attacker determines the Plex Media Server version to confirm it predates 1.43.3.10861.

2. Access precondition. For the remote path, the attacker needs a valid session token. This could be the attacker's own low-privilege account on a shared server, a token obtained through other means, or a token from any user able to authenticate. For the LAN-adjacent path, the attacker instead supplies an X-Forwarded-For header, which the server accepts as an origin/trust signal, allowing the request to reach the vulnerable handler without a valid session.

3. Triggering the traversal. The attacker issues a request to /system/agents/media/get with a url parameter crafted to include ../ sequences. Because the server builds a file path from this parameter without validating for traversal, the path escapes its intended directory and resolves to an arbitrary file. The attacker iterates the sequence to walk up to sensitive locations on the target filesystem, using error differences or response content to map the directory structure (a path-traversal enumeration pattern).

4. Post-exploitation read of the PlexOnlineToken. The attacker reads files accessible to the target user, prioritizing the PlexOnlineToken. Once obtained, this token grants control of the Plex account and the associated server. With account and server control, the attacker can enumerate libraries, reconfigure the server, and pivot to further sensitive data; if the server process runs with elevated filesystem rights, the file-read primitive may extend to additional host files.

The exploit does not require user interaction (UI:N) and has low attack complexity (AC:L). The principal constraints are the access precondition (a session token, or LAN adjacency with a spoofable X-Forwarded-For) and knowledge of the target's file layout, which is standard for traversal exploitation.

Impact Assessment

The CVSS 3.1 base score is 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Decoded:

• AV:N (Network): exploitable remotely over the network; no physical or adjacent-only restriction is assumed for the primary path (the LAN-adjacent path is an additional exposure, not a limitation).
• AC:L (Low): no specialized conditions or race windows are described.
• PR:L (Low): requires low privilege — a valid session token for the remote path, or LAN adjacency with a spoofable header.
• UI:N (None): no victim action is required.
• S:U (Unchanged): impact stays within the Plex server's authority.
• C:H (High): high confidentiality impact, driven by arbitrary file read and specifically disclosure of the PlexOnlineToken.
• I:N / A:N: no integrity or availability impact described.

Business impact. The most serious consequence is credential compromise. The PlexOnlineToken is described as granting control of the Plex account and the server, so a successful read converts a file-disclosure bug into account and server takeover. For organizations or individuals running Plex on the same host or network as other assets, the file-read primitive can expose configuration files, credentials, or other sensitive data accessible to the server process, expanding the blast radius beyond Plex itself.

Affected systems. All Plex Media Server deployments below 1.43.3.10861. Exposure is greatest for internet-facing instances and for servers sharing a LAN with untrusted clients. Shared or multi-user servers amplify the PR:L precondition, since any authenticated user can serve as the foothold.

Blast radius. Constrained by the permissions of the user context under which Plex runs. If Plex runs as a low-privilege service account, the readable file set is narrower; if it runs with broad filesystem access, the exposure widens accordingly. The absence of integrity and availability impact limits the immediate effect to disclosure, but the account/server takeover enabled by the token means downstream impact can be substantially larger than the base score alone suggests.

Detection Guidance

Sigma Rule

title: Plex Media Server Path Traversal via /system/agents/media/get
id: 3b8f0c62-7a1e-4d9c-9f2a-plex96651
status: experimental
description: Detects path traversal attempts against the Plex Media Server /system/agents/media/get endpoint via ../ sequences in the url parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96651
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/system/agents/media/get'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%2F'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
  condition: selection_endpoint and selection_traversal
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate clients passing encoded paths that resolve inside the allowed directory
level: high
tags:
  - attack.t1190
  - cve.2026.96651

YARA Rule

rule CVE_2026_96651_Plex_Path_Traversal
{
    meta:
        description = "Detects Plex Media Server path traversal exploitation attempts against /system/agents/media/get"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96651"
        date = "2026-01-01"
        severity = "high"

    strings:
        $endpoint = "/system/agents/media/get" ascii wide nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" ascii nocase
        $trav3 = "..%2F" ascii
        $trav4 = "%2e%2e%2f" ascii nocase
        $trav5 = "..\\" ascii
        $param = "url=" ascii nocase

    condition:
        $endpoint and $param and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96651 Plex Media Server Path Traversal via /system/agents/media/get"; flow:established,to_server; http.uri; content:"/system/agents/media/get"; http.uri; content:"url="; http.uri; pcre:"/(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.\\\\)/i"; reference:cve,2026-96651; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96651; classtype:web-application-attack; sid:202696651; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where url.path == "/system/agents/media/get" and url.query : ("*../*" or "*..%2f*" or "*%2e%2e%2f*" or "*..%2F*") ]
  [ network where url.path == "/system/agents/media/get" and http.response.status_code == 200 ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri_lower = lower(uri)
| where match(uri_lower, "/system/agents/media/get")
| where match(uri_lower, "(\.\./|\.\.%2f|%2e%2e%2f|\.\.\\\\)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest_host
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,plex,path_traversal,">
  <rule id="202696651" level="12">
    <if_sid>31100</if_sid>
    <match>/system/agents/media/get</match>
    <regex type="pcre2">(?i)(\.\./|\.\.%2f|%2e%2e%2f|\.\.\\)</regex>
    <description>CVE-2026-96651: Plex Media Server path traversal attempt on /system/agents/media/get</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_96651,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The advisory names a fixed version (1.43.3.10861) but no patch source, vendor advisory, or workaround was confirmed in the tracked data. Treat this as unpatched until a verified vendor release is confirmed.

1. Immediate mitigations (pre-patch hardening):

• Where feasible, remove direct internet exposure of Plex Media Server. Restrict access to trusted networks or place it behind a VPN. This eliminates the primary remote attack path (AV:N).
• If Plex must be reverse-proxied, configure the proxy to strip and overwrite inbound X-Forwarded-For headers rather than passing client-supplied values through. This directly addresses the LAN-adjacent exploitation vector described in the advisory. Do not trust X-Forwarded-For from untrusted sources.
• Restrict access to the /system/agents/media/get endpoint at the proxy/WAF where operationally possible, and block requests whose url parameter contains traversal sequences (../, encoded variants).
• Deploy the Sigma, Suricata, Elastic, Splunk, or Wazuh detections above to flag traversal attempts against the endpoint.
• Run Plex Media Server under a least-privilege service account with access only to the media libraries it requires, limiting the set of files readable via traversal.
• Rotate PlexOnlineToken credentials if compromise is suspected; assume account and server control may be lost once the token is read.

2. Patch / upgrade steps:

• Upgrade Plex Media Server to 1.43.3.10861 or later once the vendor release is independently verified. Confirm the build number in the Plex settings or update channel.
• After upgrading, verify the /system/agents/media/get endpoint rejects ../ sequences in the url parameter.
• Re-audit X-Forwarded-For handling in any reverse-proxy configuration to ensure trust boundaries are correctly enforced.

3. Long-term hardening:

• Canonicalize and validate all filesystem paths derived from user input; reject paths containing traversal sequences and confine reads to an allowlisted base directory (mitigating CWE-22 at the code/config layer).
• Adopt a strict trust model for client-supplied headers; terminate and sanitize forwarding headers only at controlled proxies.
• Keep Plex Media Server current and monitor the vendor's release notes for the fixed build.
• Maintain network segmentation so that the Plex host does not share credentials or sensitive data with higher-value assets.

References

• NVD — CVE-2026-96651: https://nvd.nist.gov/vuln/detail/CVE-2026-96651
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Plex Media Server download / release information: https://www.plex.tv/media-server-downloads/
• FIRST EPSS: Not yet scored for CVE-2026-96651 (no EPSS value available at time of writing)

No public proof-of-concept, exploit code, or Nuclei template was identified in the provided data. CVE-2026-96651 is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor campaigns or exploit-in-the-wild evidence were identified in the source data.