File Name or Path Control Vulnerability in Plex Media Server
CISA has issued an alert regarding an actively exploited file name or path control vulnerability (CVE-2026-96656) in Plex Media Server. This flaw allows an admin user to write arbitrary files that can be executed upon loading.
Summary: CISA has issued an alert regarding an actively exploited file name or path control vulnerability (CVE-2026-96656) in Plex Media Server. This flaw allows an admin user to write arbitrary files that can be executed upon loading.
A critical security vulnerability (CVE-2026-96656) allowing external control of file names or paths has been identified in Plex Media Server. This flaw is listed in CISA’s KEV catalog and is actively being exploited, posing a significant security risk to Plex users.
This vulnerability permits an administrative user to write arbitrary files onto the server. These written files can then be executed by Plex’s loading mechanisms. Such vulnerabilities typically arise when an application fails to adequately validate or restrict user input during file system operations. This allows an attacker to place a malicious script or configuration file.
In live systems, exploiting this vulnerability could lead to remote code execution on the system running Plex Media Server. The fact that this vulnerability can be chained with other Plex flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655) amplifies the impact of an attack. An attacker could thereby gain full control over the system or access sensitive data.
Everyone using Plex Media Server should apply vendor-released updates as soon as possible and check their systems for potential compromise. Furthermore, it is important that Plex servers are not directly exposed to the internet and that strong authentication mechanisms are used.
🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar