[CVE-2026-96656] Plex Media Server — Plex Media Server External Control of File Name or Path Vulnerability

What happened?

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

Key details

• Strapi stores sensitive information in cleartext, exposing user details to admin panel attackers.
• The vulnerability can be combined with CVE-2023-22621 to achieve remote code execution.
• Impacted Strapi products may be end-of-life or end-of-service.
• Forensic triage is required per BOD 26-04 for this vulnerability.
• Organizations must apply vendor mitigations and follow BOD 26-04 patching guidance.
• Stakeholders must evaluate internet exposure and adhere to BOD 26-04 guidelines.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.