Plex · Plex Media Server
Updated October 22, 2026
An SSRF bug allows any user with an X‑Plex‑Token to force the server to POST arbitrary URLs via the ‘protocol’ parameter. Attackers can combine this with other Plex flaws to achieve code execution.
Exploitation can lead to internal network reconnaissance, credential harvesting, or chaining to remote code execution on the media server.
Update Plex Media Server to the latest version; if patching is delayed, restrict X‑Plex‑Token usage, disable external access, and block outbound traffic from the server to untrusted destinations.
More active vulnerabilities