Plex · Plex Media Server
Updated October 22, 2026
A second SSRF issue in the ‘/video/:/transcode/universal’ path allows authenticated users to request arbitrary internal or external addresses. Combined with other Plex flaws, it enables full server takeover.
Attackers can reach internal services, retrieve secrets, or trigger further exploits that lead to code execution on the media server.
Upgrade to the patched release; if not possible, restrict access to the transcode endpoint to trusted IPs and monitor for unusual outbound requests.
More active vulnerabilities