{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-96655",
  "revision": 1,
  "title": "Plex Media Server — Transcode Path Request Forgery",
  "summary": "A server-side request forgery (SSRF) flaw in Plex Media Server before 1.43.3.10861 lets an authenticated user make the server request arbitrary internal or external addresses through the transcode path. It can be chained with three other Plex flaws.",
  "source_type": "cve",
  "severity": "medium",
  "cvss": {
    "score": 5.3,
    "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
    "version": "4.0"
  },
  "epss": 0.01637,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2026-10-20",
    "kev_due": "2026-11-03",
    "prerequisites": "An authenticated user account on the Plex Media Server."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "1.43.3.10861"
    ]
  },
  "recommended_action": "Update Plex Media Server to 1.43.3.10861 or later.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-96655",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "writeup",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
    },
    {
      "type": "writeup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96655"
    },
    {
      "type": "writeup",
      "url": "https://zmain.info/blog/plex2shell"
    }
  ],
  "published_at": "2026-09-23T17:17:23.677Z",
  "issued_at": "2026-11-05T07:48:47.009Z",
  "tags": [
    "plex",
    "ssrf"
  ]
}