Critical Severity
CVE-2026-96654
Published: Nov 6, 2026
CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
# plex2shell
Unauth RCE chain for Plex Media Server <= 1.43.3.10828. Fixed in 1.43.3.10861. Update ASAP.
**CVSS 3.1: 9.8** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
Write-up: **<https://zmain.info/blog/plex2shell>**
## Disclaimer
This tool is published for authorized security testing, academic research,
and defensive purposes only. Use it only against systems you own or have
explicit written permission to test. The authors are not responsible for
misuse or damage caused by this tool. Unauthorized access to computer
systems is illegal.
## CVEs
| CVE | Primitive |
| --- | --- |
| CVE-2026-96652 | Unauthenticated SSRF via `/player/timeline` `protocol=` |
| CVE-2026-96654 | Loopback pivot: dead auth guard + `searchOne` `identifier=` injection |
| CVE-2026-96655 | Owner-authed transcoder SSRF + arbitrary-path file write (`dump-yuv`) |
| CVE-2026-96656 | Code execution via unsigned codec `dlopen` in the Codecs set-dir |
## Prerequisites
- Python 3.8+, `ffmpeg`, `gcc` (or `x86_64-w64-mingw32-gcc` for Windows targets)
- Attacker host reachable from the target (media fetch + reverse shell)
## License
GPLv3