# plex2shell

Unauth RCE chain for Plex Media Server <= 1.43.3.10828. Fixed in 1.43.3.10861. Update ASAP.

**CVSS 3.1: 9.8** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Write-up: **<https://zmain.info/blog/plex2shell>**


## Disclaimer

This tool is published for authorized security testing, academic research,
and defensive purposes only. Use it only against systems you own or have
explicit written permission to test. The authors are not responsible for
misuse or damage caused by this tool. Unauthorized access to computer
systems is illegal.

## CVEs

| CVE | Primitive |
| --- | --- |
| CVE-2026-96652 | Unauthenticated SSRF via `/player/timeline` `protocol=` |
| CVE-2026-96654 | Loopback pivot: dead auth guard + `searchOne` `identifier=` injection |
| CVE-2026-96655 | Owner-authed transcoder SSRF + arbitrary-path file write (`dump-yuv`) |
| CVE-2026-96656 | Code execution via unsigned codec `dlopen` in the Codecs set-dir |

## Prerequisites

- Python 3.8+, `ffmpeg`, `gcc` (or `x86_64-w64-mingw32-gcc` for Windows targets)
- Attacker host reachable from the target (media fetch + reverse shell)

## License

GPLv3