Four Plex Media Server flaws: from SSRF to file write with code execution

Plex Media Server before 1.43.3.10861 is affected by four separate flaws: SSRF in the timeline handler (CVE-2026-96652, CVSS 4.3), unauthenticated URL injection in searchOne (CVE-2026-96654, 6.5), SSRF via the transcode path parameter (CVE-2026-96655, 4.3) and arbitrary file write via TranscoderH264Options (CVE-2026-96656, 7.2). The last requires admin rights but can lead to code execution because the server loads .so files without signature checks.

• CVE-2026-96656: file write at CVSS 7.2, requires admin access
• CVE-2026-96654: unauthenticated URL injection in searchOne, CVSS 6.5
• Timeline and transcode SSRF flaws each rated 4.3
• Fix is Plex Media Server 1.43.3.10861 or later