Authenticated Path Traversal in Plex Media Server Exposes PlexOnlineToken
Plex Media Server before 1.43.3.10861 fails to sanitize the url parameter at the /system/agents/media/get endpoint, allowing ../ sequences to traverse out of the intended directory. A remote attacker holding any valid session token can use this to read arbitrary files accessible to the account running the server, including the PlexOnlineToken, which confers full control of the associated Plex account and server. The same flaw is reachable by a LAN-adjacent attacker who supplies a spoofed X-Forwarded-For header, meaning a guest device on the home network may not even need stolen credentials. All self-hosted servers on older versions are affected, whether exposed directly on port 32400, published via reverse proxy, or reachable on the LAN. The flaw is rated CVSS 4.0 7.1 (high); no public PoC exists and no exploitation has been observed.
What to do: Upgrade Plex Media Server to 1.43.3.10861 or later immediately, ideally via the built-in updater. Restrict port 32400 so it is not directly reachable from the internet (use VPN, firewall rules, or Plex Relay instead of port forwarding), and review reverse-proxy configuration to ensure client-supplied X-Forwarded-For headers are not trusted from untrusted networks. If a server ran a vulnerable version, inspect logs for suspicious requests to /system/agents/media/get and reset the Plex account (sign out all devices / re-authenticate) to invalidate a potentially stolen PlexOnlineToken.
| Plex Media Server | before 1.43.3.10861 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
Ravie Lakshmanan Oct 19, 2026 Vulnerability / Web Security Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different…