Executive brief
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Junglewise Threat Intelligence
CVE-2026-96655: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/tra
CVE-2026-96655 · Severity: medium · CVSS 4.3 · Published 2026-09-23