Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
PoC: plex2scan
Find Plex Media Servers affected by Plex2Shell (CVE-2026-96652 and three more)
PoC: plex2shell-check
Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?
PoC: B63-POC-CVE-2026-96652
PoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)
PoC: plex2shell-windows-hunt
Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script
PoC: plex2shell-check
Read-only Linux check for Plex2Shell (CVE-2026-96652/-96654/-96655/-96656) exploitation and the XMRig/proxy payloads seen in the wild
PoC: plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
PoC: plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
PoC: plex2shell
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free