Source: cisa.gov
Plex Media Server versions v1.43.2 and earlier contain an external control of file name or path vulnerability (CVE-2026-96656) that allows an admin user to write arbitrary files which may be executed on load. This vulnerability is part of a chain that includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. The vulnerability was disclosed via the Plex forums and listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements are also outlined under BOD 26-04 implementation guidance. The chaining of these CVEs increases the overall risk and potential impact significantly. Affected users are urged to update to a patched version of Plex Media Server immediately.
