Plex Media Server EUVD-2026-85369

Requires an authenticated Plex Media Server account (PR:L) - any valid user, including a low-trust invited/shared-library user, can reach the vulnerable '/video/:/transcode/universal' endpoint. Exploitation is possible remotely over the network with low complexity by supplying an attacker-controlled internal or external address in the transcode path parameter. Limiting factors: a valid authenticated session is mandatory (no unauthenticated path), the server must be running a version before 1.43.3.10861, and real impact depends on network exposure - an internet-facing or flat-network Plex server yields far more internal reachability than a well-segmented one. No user interaction beyond the attacker's own authenticated request is needed.

This is a moderate, not critical, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) describes a network-reachable but authenticated (PR:L) SSRF with only low confidentiality impact and no integrity or availability impact - consistent with CWE-918. No EPSS score, KEV listing, or explicit POC flag was provided in the input, so there is no signal of active exploitation. The one notable signal is the reference to a third-party writeup titled 'plex2shell' (zmain.info), whose name implies a documented exploitation chain, but this is a blog analysis rather than a confirmed weaponized exploit or CISA KEV entry. Contrast the signals: the CVSS is deliberately conservative (C:L, S:U) because base scoring does not credit the fact that SSRF can pivot into an internal network, so real-world impact in a poorly segmented deployment could exceed the 4.3 score - internal service enumeration, cloud metadata access, or chaining toward further compromise. Net: a real but authentication-gated priority, worth patching promptly on internet-exposed or shared Plex servers, but not an emergency remote-unauthenticated flaw.

An attacker with any valid Plex account (or a low-trust shared-library user) sends a crafted request to the '/video/:/transcode/universal' endpoint with a path parameter pointing at an internal address, causing the server to fetch it and return or leak the response. This enables internal network probing, access to internal-only services, or cloud metadata endpoints; a third-party 'plex2shell' writeup suggests the technique has been publicly documented as part of a larger chain.