Plex Media Server CVE-2026-96654

Requires network access to a Plex Media Server running a version before 1.43.3.10861, and specifically the use of the 'searchOne' search parameter that fails to neutralize embedded URL values, enabling cross-plugin function invocation with attacker-supplied parameters. The CVSS vector asserts no privileges and no user interaction (PR:N/UI:N), meaning exploitation against a reachable server does not require victim action; however, real-world reachability depends on whether the Plex server/API is exposed beyond localhost and whether an authentication token is actually enforced - the vector's PR:N should be validated because Plex APIs commonly require a server token. Impact is limited to LOW confidentiality and LOW integrity per the base metrics unless chained further.

The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) scores 6.9 (medium), describing a network-reachable, low-complexity flaw with no privileges or user interaction but only LOW confidentiality and integrity impact and no availability impact - consistent with a request-forgery/parameter-injection class issue (CWE-84) rather than direct code execution. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no exploit is flagged in the input, so there is no evidence of widespread automated exploitation at this time. The signals are internally consistent (network vector matches a URL-neutralization bug in a media-server web API), so this is a genuine but moderate-priority issue rather than a critical one. One caveat: the reference blog titled 'plex2shell' (zmain.info) hints at possible escalation beyond the modest VC:L/VI:L impact - this should be reviewed directly, because if cross-plugin invocation can be chained to command/shell execution the real-world impact would exceed the assigned base metrics. Also, PR:N (unauthenticated) is asserted by the vector but the Plex API frequently requires a server token; verify the true authentication requirement with the vendor.

A remote attacker sends a crafted request to a Plex Media Server's search functionality, embedding a malicious URL in the 'searchOne' value that is not correctly neutralized, causing the server to invoke functions belonging to other plugins with attacker-controlled parameters. This lets the attacker reach and drive plugin functionality that was not meant to be externally callable, yielding limited information disclosure and limited tampering. A public technical writeup/PoC appears to exist at zmain.info ('plex2shell'), but the input does not formally flag POC availability, so it should be treated as unverified.