Plex Media Server before version 1.43.3.10861 contains a CWE-22 path traversal vulnerability due to insufficient validation of pathname components derived from the URL parameter in the '/system/agents/media/get' endpoint. An attacker possessing a valid session token can exploit this flaw to read any file accessible to the user, including the PlexOnlineToken, which can lead to account and server control. Additionally, a LAN-adjacent attacker can exploit the vulnerability by supplying a malicious X-Forwarded-For header to achieve similar unauthorized file access.

Successful exploitation allows an attacker with a valid session token or a LAN-adjacent attacker to read arbitrary files on the server that the user can access. This includes sensitive credentials such as the PlexOnlineToken, potentially enabling full control over the Plex account and server. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk.

A fix is available in Plex Media Server version 1.43.3.10861. Users should upgrade to this version or later to remediate the vulnerability. No vendor advisory content was provided, so patch status is based on the version information given. Until patched, restrict access to the server and session tokens to trusted users only.