CVE-2026-96656: CWE-73 External Control of File Name or Path in Plex Media Server
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
AI Analysis
Technical Summary
Plex Media Server prior to version 1.43.3.10861 contains an external control of file name or path vulnerability (CWE-73). An administrator can inject arbitrary files via the TranscoderH264Options preference, which is appended verbatim to the x264 encoder options during transcoding. Upon server startup, all shared object (.so) files are executed without verifying signatures, execute permissions, or symbols, enabling potential arbitrary code execution.
Potential Impact
An attacker with admin privileges can write arbitrary files that may be executed by the server on startup, potentially leading to arbitrary code execution. This elevates the risk of full system compromise or unauthorized actions performed by the Plex Media Server process.
Mitigation Recommendations
Upgrade Plex Media Server to version 1.43.3.10861 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the affectedVersions field indicating fixed in 1.43.3.10861.
CVE-2026-96656: CWE-73 External Control of File Name or Path in Plex Media Server
Description
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
CVSS v4.0
Score 8.6high
Affected software
Plex
Media Server
pkg:github/plexinc/plex-media-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Plex Media Server prior to version 1.43.3.10861 contains an external control of file name or path vulnerability (CWE-73). An administrator can inject arbitrary files via the TranscoderH264Options preference, which is appended verbatim to the x264 encoder options during transcoding. Upon server startup, all shared object (.so) files are executed without verifying signatures, execute permissions, or symbols, enabling potential arbitrary code execution.
Potential Impact
An attacker with admin privileges can write arbitrary files that may be executed by the server on startup, potentially leading to arbitrary code execution. This elevates the risk of full system compromise or unauthorized actions performed by the Plex Media Server process.
Mitigation Recommendations
Upgrade Plex Media Server to version 1.43.3.10861 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the affectedVersions field indicating fixed in 1.43.3.10861.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-09-23T14:42:33.270Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab3ff4ff7a7c541060b3043
Added to database: 09/23/2026, 16:33:19 UTC
Last enriched: 09/23/2026, 16:47:39 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.