Plex · Plex Media Server
Updated October 22, 2026
Improper neutralization of encoded URI schemes lets attackers invoke functions in other plugins with crafted parameters. When chained with related Plex bugs, it can lead to arbitrary code execution.
An attacker could manipulate plugin behavior, upload malicious payloads, and execute them on the server, compromising media libraries and the host system.
Deploy the vendor’s security update; temporarily disable third‑party plugins and enforce strict Content‑Security‑Policy headers until patched.
More active vulnerabilities