Plex Media Server EUVD-2026-85366

Exploitation requires reaching the /system/agents/media/get endpoint and supplying a url parameter containing ../ traversal sequences. The primary path requires a valid Plex session token (PR:L) - a remote authenticated user. A secondary, lower-barrier path exists for LAN-adjacent attackers who can supply a crafted X-Forwarded-For header, which the server trusts to establish local context. Read access is bounded to files the target user's account can access, but this includes the PlexOnlineToken store, making the practical ceiling full account/server takeover. Limiting factors: requires either a session token or LAN adjacency with header spoofing; fully fixed in Plex Media Server 1.43.3.10861 and later.

This is a moderate-to-serious priority driven by impact escalation, not by exploitation signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) describes a network-reachable, low-complexity path traversal requiring only a valid low-privilege session token, with high confidentiality impact and no integrity/availability impact. The raw file-read is scoped to files the target user can access, but the description explicitly notes the leaked PlexOnlineToken grants control of the Plex account and server - meaning the effective consequence is account/server takeover, which the base VC:H alone understates. No EPSS score, no CISA KEV listing, and no confirmed public exploit are present in the input, so there is no evidence of active or automated exploitation at this time - the priority rests on the low attack complexity, the huge install base of Plex, and the referenced 'plex2shell' write-up hinting at a token-to-shell chain. Two access paths exist and should be assessed separately: (1) a remote attacker who already holds a valid session token (PR:L), and (2) a LAN-adjacent attacker who can forge a client-supplied X-Forwarded-For header, which effectively lowers the authentication bar on local networks and is a meaningful risk multiplier for exposed home/SMB deployments.

An attacker holding a valid Plex session token (or a LAN-adjacent attacker forging an X-Forwarded-For header) sends a request to /system/agents/media/get with a url parameter containing ../ sequences, causing the server to read an arbitrary file such as the one storing the PlexOnlineToken. With that token the attacker takes over the victim's Plex account and server. No confirmed public exploit is in the input, though a third-party 'plex2shell' blog describes chaining the leaked token toward code execution.