CVE-2026-96656 Plex Media Server External Control of File Name or Path

Exploited in the wild High 8.6 Published 23 Sep 2026 Updated 21 Oct 2026

An admin user can write arbitrary files that execute on load due to unsafe handling of transcoder options and missing signature checks.

Exploited in the wild: Since 20 Oct 2026
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-96656?

CVE-2026-96656 is a high-severity path traversal vulnerability in Plex Media Server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Weakness: CWE-73

Which versions are affected by CVE-2026-96656?

It affects 1 product.

Products include Plex Media Server.

How do I fix CVE-2026-96656?

No fix has been published for CVE-2026-96656 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Oct 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-96656 being exploited?

Yes. Attackers have exploited CVE-2026-96656 in the wild since at least 20 Oct 2026.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-2g2v-9wf5-6m3g.