{"cve":"CVE-2026-96654","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[0,1.43.3.10861)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"1.43.3.10861"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Media Server","source":"cna","vendor":"Plex"},"product":"media_server","vendor":"plex"}],"created":"2026-09-23T18:00:07.947100+00:00","updated":"2026-09-23T18:30:06.735097+00:00","vendors":["plex","plex$PRODUCT$media_server"]},"mitre":{"cpes":[],"created":"2026-09-23T16:06:35.821000+00:00","description":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cvssV4_0":{"score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}},"mitre_repo_path":"cves/2026/96xxx/CVE-2026-96654.json","references":["https://forums.plex.tv/t/plex-media-server/30447/711","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://www.cve.org/CVERecord?id=CVE-2026-96654","https://zmain.info/blog/plex2shell"],"title":"Plex Media Server URL injection","updated":"2026-09-23T16:46:13.200000+00:00","vendors":[],"weaknesses":["CWE-84"]},"nvd":{"cpes":[],"created":"2026-09-23T17:17:23.517000+00:00","description":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cvssV4_0":{"score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-96654.json","references":["https://forums.plex.tv/t/plex-media-server/30447/711","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://www.cve.org/CVERecord?id=CVE-2026-96654","https://zmain.info/blog/plex2shell"],"title":null,"updated":"2026-09-23T17:58:26.570000+00:00","vendors":[],"weaknesses":["CWE-84"]},"opencve":{"changes":[{"created":"2026-09-23T16:30:00+00:00","data":[{"details":{"new":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","old":null},"type":"description"},{"details":{"new":"Plex Media Server URL injection","old":null},"type":"title"},{"details":{"added":["CWE-84"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://forums.plex.tv/t/plex-media-server/30447/711","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://www.cve.org/CVERecord?id=CVE-2026-96654","https://zmain.info/blog/plex2shell"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cvssV4_0":{"score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"60423d99-3522-48c2-9655-41af6b07321f"},{"created":"2026-09-23T17:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"f8c54304-e712-4abf-a006-2be9d7bcf129"},{"created":"2026-09-23T18:45:00+00:00","data":[{"details":["plex","plex$PRODUCT$media_server"],"type":"first_time"},{"details":{"added":["plex","plex$PRODUCT$media_server"],"removed":[]},"type":"vendors"}],"id":"91e6331e-2896-4b6d-a9d6-0e2e65610fba"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-09-23T16:06:35.821000+00:00","provider":"mitre"},"description":{"data":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{"score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"},"provider":"mitre"},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://forums.plex.tv/t/plex-media-server/30447/711","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","https://www.cve.org/CVERecord?id=CVE-2026-96654","https://zmain.info/blog/plex2shell"],"providers":["mitre","nvd"]},"title":{"data":"Plex Media Server URL injection","provider":"mitre"},"updated":{"data":"2026-09-23T18:30:06.735097+00:00","provider":"enrichment"},"vendors":{"data":["plex","plex$PRODUCT$media_server"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-84"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-09-23T16:06:35.821000+00:00","description":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Plex Media Server URL injection","updated":"2026-09-23T16:36:27.805000+00:00","vendors":[],"vulnrichment_repo_path":"2026/96xxx/CVE-2026-96654.json","weaknesses":[]}}