AI analysis
Claude Opus · 6 Nov 2026, 10:20 CET
Plex Media Server flaw lets admin accounts plant files that run as code
Plex Media Server before 1.43.3.10861 lets an admin-level user write arbitrary files that can be executed when the server loads them. CISA lists it as exploited in the wild. Update to 1.43.3.10861 or later and review admin access.
In plain terms
Plex Media Server is software that organises and streams personal video, music and photo libraries. In versions before 1.43.3.10861, someone with administrator access to the server can abuse a transcoding setting to write files of their choosing onto the machine. Transcoding means converting media on the fly into a format a device can play. Because the server automatically loads certain library files (shared object, or .so, files) at startup without checking them, a planted file can end up running as program code.
This matters to anyone running Plex at home, in a small office or on a shared server. The attacker needs admin rights first, but if an admin account or session is stolen, this flaw can turn that access into full control of the server and the machine it runs on. CISA has confirmed that this vulnerability is being exploited.