Plex · Plex Media Server
Updated October 22, 2026
An external control of file name/path bug lets admin users write arbitrary files that may be executed on load. When chained with other Plex vulnerabilities, it provides a path to remote code execution.
A malicious admin could plant web‑shells or malicious binaries, leading to persistent compromise and potential ransomware deployment.
Apply the latest Plex update; enforce least‑privilege for admin accounts and audit file system writes for unexpected locations.
More active vulnerabilities