Plex Media Server CVE-2026-96652

Exploitation targets the '/player/timeline' endpoint and requires supplying any X-Plex-Token value plus a full attacker-controlled URL in the 'protocol' parameter; the server then performs the outbound POST. Per the CVSS vector this is a network-reachable, low-complexity request needing low privileges (PR:L, some token value) and no user interaction. Limiting factors: the attacker must reach the Plex server over the network and present a usable X-Plex-Token, and the impact is a blind forced POST (confidentiality-low, no integrity/availability impact) rather than a full read primitive, so value depends on what internal targets the server can reach. Affects Plex Media Server before 1.43.3.10861; upgrade to that version remediates.

This is a genuine but low-priority SSRF. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, and requiring only 'any X-Plex-Token value' (PR:L). The impact is deliberately scoped - confidentiality-low, integrity/availability none - because the primitive is a blind/forced server-side POST to an attacker-chosen destination rather than confirmed data exfiltration or code execution. No EPSS score, KEV listing, or confirmed POC is present in the input, so all three of the strongest real-world-exploitation signals are ABSENT; there is no SSVC decision data either. The one referenced blog ('plex2shell') hints at chaining SSRF toward a shell, but that chain is not demonstrated in the provided data and should be treated as speculative, not confirmed. Net: a real, low-effort SSRF worth patching in internet-exposed or pivot-sensitive deployments, but not an emergency absent evidence of active exploitation. Note the description says 'any X-Plex-Token value,' which reads weaker than a normal authenticated requirement - verify with the vendor whether a valid session is truly needed, as this borders on PR:N.

An attacker who can reach a Plex Media Server and present any X-Plex-Token sends a crafted request to '/player/timeline' with a full attacker-controlled URL in the 'protocol' parameter, causing the server to issue an outbound POST to that destination. This can be used to probe or hit internal/cloud-metadata services behind the server's network position or to exfiltrate a request to an external listener. No public exploit is identified in the provided data, though a referenced blog discusses potential SSRF-to-shell chaining.