← Back

CVE-2026-96654

nvd nist
Published: Sep 23, 2026Modified: Oct 21, 2026CISA KEV

JSON object

Loading...
6.9
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)

Description

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

Affected (1)

Products: Plex: Media Server
Plex
1 product
Media Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Media Server
version < 1.43.3.10861

Related CWEs

CWE-84
Improper Neutralization of Encoded URI Schemes in a Web Page
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

References (5)

Source: 9119a7d8-5eab-497f-8521-727c672e3725
Release Notes
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Third Party Advisory
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Third Party AdvisoryVDB Entry
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.