CVE-2020-5740 Code injection in Plex Media Server (Windows)
A local unauthenticated attacker can execute arbitrary Python code with SYSTEM privileges on Windows Plex Media Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5740?
CVE-2020-5740 is a high-severity code injection vulnerability in Plex Media Server (Windows), published on 22 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.
Weakness: CWE-427
Which versions are affected by CVE-2020-5740?
It affects 1 product.
Products include Plex Media Server.
How do I fix CVE-2020-5740?
No fix has been published for CVE-2020-5740 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-5740 being exploited?
There is no known exploitation of CVE-2020-5740 in the wild and no public exploit code.
Other vulnerabilities in Plex Media Server (Windows)
- CVE-2026-96656 Plex Media Server External Control of File Name or Path
- CVE-2020-5741 Plex Media Server Remote Code Execution
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)
Sources
Also known as GHSA-qmvf-m2cm-gm9v.