CVE-2026-96654

{
  "etk_id": "ETK-2026-2018",
  "cve_id": "CVE-2026-96654",
  "display_id": "CVE-2026-96654",
  "ghsa_id": "GHSA-3j7c-jr86-m5jq",
  "euvd_id": "EUVD-2026-85368",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Plugin function injection via URL handling in Plex Media Server",
  "summary": "Plex Media Server versions earlier than 1.43.3.10861 mishandle URL input processed by searchOne. An attacker able to supply values to that functionality may cause calls to functions in other plugins using attacker-selected parameters. The evidence does not fully establish which deployments make this functionality remotely reachable without prior access.",
  "mitigation": "Upgrade Plex Media Server to version 1.43.3.10861 or later. Until upgraded, restrict access to the server and its management interfaces to trusted networks and users.",
  "vendor": "plex",
  "product": "media_server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.43.3.10861"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.43.3.10861"
      ],
      "package_name": "Media Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 6.9,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0023,
  "epss_percentile": 0.1258,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 15.1742027,
  "t0_at": "2026-09-23T16:06:35.821000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T22:44:17.106120+00:00",
      "days": 25.276172281481482,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:06:35.821000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-18T00:00:00+00:00",
      "days": 25,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:06:35.821000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-96654"
    },
    "public_poc": {
      "at": "2026-10-17T01:44:36+00:00",
      "days": 23.401390960648147,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:06:35.821000+00:00",
      "url": "https://github.com/gmh5225/plex2shell"
    },
    "trigger_signal": {
      "at": "2026-10-18T00:00:00+00:00",
      "days": 24.328752071759258,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T16:06:35.821000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-96654"
    }
  }
}