A path traversal vulnerability in Plex Media Server allows authenticated or LAN-adjacent attackers to read sensitive files, potentially leading to full account and server compromise.

The application fails to sanitize ../ sequences in the url parameter when processing requests to /system/agents/media/get. This flaw allows an attacker with a valid session token, or a LAN-adjacent attacker utilizing an X-Forwarded-For header, to bypass directory restrictions and access arbitrary files on the host system.

The ability to read arbitrary files poses a severe risk to data confidentiality and system integrity. An attacker can retrieve the PlexOnlineToken, which grants complete control over the victim's Plex account and the media server instance. Given the potential for total administrative takeover, the impact is significant despite the medium CVSS score, as it facilitates lateral movement and unauthorized data access.

Immediate Action: Update Plex Media Server to version 1.43.3.10861 or later to implement proper path validation.

Proactive Monitoring: Review access logs for requests to the /system/agents/media/get endpoint containing suspicious path traversal patterns or unexpected X-Forwarded-For headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing directory traversal sequences (../) directed at the Plex Media Server endpoints.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to the security of your Plex Media Server environment. Administrators should prioritize patching to version 1.43.3.10861 immediately to close the path traversal vector. Failure to remediate could allow an attacker to gain persistent unauthorized access to your media library and administrative controls.