CVE-2026-96654

Executive Summary

CVE-2026-96654 is a URL neutralization weakness (CWE-84) in Plex Media Server versions before 1.43.3.10861. The searchOne functionality fails to properly neutralize URL values, allowing an unauthenticated network attacker to invoke functions belonging to other plugins while supplying attacker-controlled parameters. Although the CVSS base score is 6.5 (Medium), the plugin-to-plugin invocation primitive can expose internal functionality not intended for external callers, giving an attacker low-impact confidentiality and integrity effects across the media server and its installed plugin ecosystem.

Technical Analysis

The vulnerability is rooted in incorrect neutralization of URL values that are passed into the searchOne handler of Plex Media Server. CWE-84 ("Improper Neutralization of Encoded URI Schemes in a Web Page") describes a class of flaws in which user-supplied input is incorporated into a URL context without adequate encoding or allow-list validation, allowing the attacker to control which resource or function is ultimately reached.

In this instance, the NVD description states that Plex Media Server before 1.43.3.10861 "does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters." Two distinct weaknesses compound here:

1. Cross-plugin function invocation. Because searchOne does not constrain the URL value it processes, an attacker can craft input that causes the server to dispatch a request to a plugin other than the one that was intended to handle the search. This is effectively an unauthorized reachability primitive across plugin boundaries. The trust boundary between the core server and installed third-party plugins is not enforced at this entry point.

2. Attacker-controlled parameters to those functions. The attacker is not limited to choosing a target function; they also supply the parameters that the target function receives. This converts the flaw from a simple access-control bypass into a parameter-injection primitive against whatever plugin endpoints become reachable.

From a network perspective, the attack surface is the Plex Media Server HTTP interface. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerable path is reachable over the network with no authentication and no user interaction, and that exploitation requires no special conditions beyond network reachability of the service. The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component's security authority, which is consistent with an attacker reaching plugin functions within the same Plex process or trust domain. The impact sub-scores are limited: C:L (Low confidentiality) and I:L (Low integrity), with A:N (no availability impact). This is consistent with a primitive that exposes or manipulates plugin-level data and behavior rather than granting full server compromise.

The specific function names, URL paths, and parameter names of the affected plugins are not enumerated in the available data. What is well-supported by the description is the mechanism: unvalidated URL values in searchOne act as an open redirect/SSRF-like dispatch mechanism into other plugins' function handlers with attacker-supplied arguments. No public proof-of-concept, Nuclei template, or exploit code is available, so the attack chain below is described at the vulnerability-class level.

Exploitation Scenarios

The following chain is inferred strictly from the vulnerability class (CWE-84) and the single sentence of description provided. No public PoC is available; no specific plugin names, function names, or parameter names are asserted because none are present in the source data.

1. Reconnaissance / target identification. The attacker identifies an exposed Plex Media Server instance reachable over the network (the CVSS vector's AV:N/PR:N/UI:N profile means no credentials or user action are required). Typical discovery uses Shodan-style enumeration of internet-facing Plex services or direct probing of the server's HTTP listener. The attacker determines which plugins are installed or which plugin namespaces the server recognizes, since only reachable plugins can be targeted.

2. Triggering the flaw class. The attacker sends a crafted request that reaches the searchOne handler and includes a URL value that is not correctly neutralized. Instead of being confined to the intended search target, the unvalidated URL value determines the destination that the server processes. This is the core CWE-84 behavior: the input is interpreted as a URL/URI reference and followed, rather than being encoded or restricted to an allow-listed destination.

3. Cross-plugin function invocation with attacker-supplied parameters. Because the neutralization is missing, the attacker directs the searchOne logic to call functions belonging to a different plugin. Critically, the attacker also controls the parameters passed to that function. At the vulnerability-class level, this is a parameter-injection / broken-access-control condition: the attacker can reach functionality that was never intended to be invoked from this entry point and influence how it behaves by choosing the argument values. The exact wire format, parameter names, and target routes are not disclosed in the available data and must not be assumed.

4. Post-exploitation impact. Consistent with CVSS C:L/I:L/A:N, the realistic outcome is limited disclosure of plugin-level data and limited manipulation of plugin behavior or stored state, rather than remote code execution or full server takeover. Depending on which plugins are installed and what functions become reachable, this could expose configuration or media metadata, or induce plugin actions the operator never authorized. Because scope is unchanged, the impact remains within the Plex server's trust domain; the flaw is not scored as crossing into the host operating system.

It is important to state explicitly: no public exploit, PoC, or Nuclei template exists for this CVE, and no threat-actor campaign has been attributed. Any exploitation observed in the wild would be novel and attacker-developed.

Impact Assessment

• Confidentiality (Low). The attacker can invoke other plugins' functions, which may return data the caller was not authorized to retrieve.
• Integrity (Low). Attacker-supplied parameters flow into plugin functions, allowing limited manipulation of plugin behavior or data.
• Availability (None). The vector carries A:N; no denial-of-service is scored.
• Attack complexity (Low), Privileges (None), User interaction (None). This makes the flaw remotely reachable and automatable — the primary reason a 6.5 Medium rating should not be dismissed. The only mitigating factor is the limited C/I impact.
• Blast radius. Any internet- or LAN-exposed Plex Media Server older than 1.43.3.10861 is in scope. The practical impact scales with the number and capability of installed plugins: a minimal deployment may expose little, while a heavily extended server with powerful third-party plugins could expose meaningful internal functionality. Multi-user or shared servers increase the confidentiality exposure because plugin data may include other users' content and metadata.

Business impact centers on unauthorized access to media library metadata and plugin-managed data, and potential integrity violations in plugin state. There is no evidence this leads to host compromise, so it should be triaged as an externally exploitable information-disclosure and integrity-tampering issue rather than a full breach vector.

Detection Guidance

Detection must focus on the network request to the searchOne entry point and on anomalous cross-plugin invocation patterns. Because no PoC exists, rules below are behavioral and target the vulnerability class rather than a known payload signature.

Sigma Rule

title: Plex Media Server searchOne Cross-Plugin Invocation Attempt
id: 8f3c1a2e-6b7d-4c5e-9a10-plexcve202696654
status: experimental
description: Detects requests to the Plex searchOne handler carrying URL-like or cross-plugin parameter values consistent with CVE-2026-96654 (CWE-84) exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96654
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: plex
detection:
  selection_path:
    cs-uri-query|contains:
      - 'searchOne'
  selection_urlvalue:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - '../'
      - '%2f'
      - '%2e%2e'
  selection_plugin:
    cs-uri-query|contains:
      - 'plugin'
  condition: selection_path and (selection_urlvalue or selection_plugin)
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate Plex clients performing local searches with encoded values
level: medium

YARA Rule

rule CVE_2026_96654_Plex_searchOne_URL_Neutralization
{
    meta:
        description = "Detects Plex Media Server components referencing searchOne URL handling potentially affected by CVE-2026-96654 (CWE-84)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96654"
        date = "2026-01-01"
        cve = "CVE-2026-96654"

    strings:
        $s1 = "searchOne" ascii wide nocase
        $s2 = "Plex Media Server" ascii wide nocase
        $u1 = "http://" ascii wide nocase
        $u2 = "https://" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $s1
        and $s2
        and any of ($u*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96654 Plex Media Server searchOne URL Neutralization Attempt"; flow:established,to_server; http.uri; content:"searchOne"; nocase; http.uri; content:"http"; nocase; distance:0; pcre:"/searchOne[^\r\n]*(https?%3a%2f%2f|https?:\/\/)/i"; classtype:attempted-recon; reference:cve,2026-96654; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96654; sid:202696654; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  url.query != null and
  url.query : "searchOne" and
  (url.query : "http://" or url.query : "https://" or url.query : "../" or url.query : "%2f" or url.query : "%2e%2e")

Splunk SPL Query

index=web OR index=proxy OR index=plex
| eval uri=coalesce(uri, url, request, cs_uri_query)
| where like(uri, "%searchOne%")
| where like(uri, "%http://%") OR like(uri, "%https://%") OR like(uri, "%../%") OR like(uri, "%2e%2e%") OR like(uri, "%2f%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, dest_ip, dest_port
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,plex,">
  <rule id="202696654" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>searchOne</url>
    <regex>searchOne.*(https?%3a%2f%2f|https?://|\.\./|%2e%2e|%2f)</regex>
    <description>CVE-2026-96654: Plex Media Server searchOne URL neutralization bypass attempt (possible cross-plugin invocation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_96654,attack,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence is available from any tracked source, no vendor advisory or commit reference is provided, and no affected-version package metadata is published. The NVD description nonetheless states the issue is corrected in Plex Media Server 1.43.3.10861 and later, and that statement is the only remediation anchor available.

1. Immediate mitigations.

   • Restrict network exposure of the Plex Media Server HTTP interface. Do not expose the service directly to the internet; place it behind a VPN or authenticated reverse proxy, or bind it to localhost/LAN only.
   • Enforce authentication and access control at the perimeter so that unauthenticated requests cannot reach the searchOne handler path. Note that the CVSS vector assumes PR:N, so perimeter authentication is a genuine compensating control.
   • Minimize installed plugins. Because the vulnerability enables cross-plugin function invocation, reducing the plugin attack surface directly reduces reachable functionality.
   • Where feasible, apply request filtering at the reverse proxy to reject requests to the searchOne entry point that carry URL-like or encoded traversal values.

2. Patch / upgrade steps.

   • Upgrade Plex Media Server to 1.43.3.10861 or later. Verify the running version from the Plex server settings or the server's version endpoint after upgrade.
   • Because patch confidence is 0/4 and no vendor advisory is tracked, validate the fix directly: confirm the version string, then re-test that URL values submitted via searchOne are neutralized and no longer reach other plugins' functions.
   • Monitor the Plex release channels for an official security advisory; the current lack of vendor advisory and package metadata means the fix has not been independently corroborated by tracked sources.

3. Long-term hardening.

   • Maintain a disciplined update cadence for Plex Media Server and all plugins; treat the media server as an internet-adjacent service requiring patch management.
   • Apply least-privilege to plugin installation and limit which third-party plugins can run.
   • Implement egress and egress-adjacent monitoring so that unexpected cross-plugin or outbound fetch behavior is logged and alerted.
   • Deploy the detection rules above to catch exploitation attempts and to provide visibility if the fix cannot be applied immediately.

References

• NVD — CVE-2026-96654: https://nvd.nist.gov/vuln/detail/CVE-2026-96654
• CWE-84 — Improper Neutralization of Encoded URI Schemes in a Web Page: https://cwe.mitre.org/data/definitions/84.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Plex Media Server downloads and release information: https://www.plex.tv/media-server-downloads/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96654 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploitation evidence: No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-96654, and no threat-actor campaign or in-the-wild exploitation has been identified in the available data. The vulnerability is not listed in CISA KEV, and EPSS has not yet scored it.