Plex Media Server prior to version 1.43.3.10861 allows a path traversal flaw in the /system/agents/media/get endpoint. A user with a valid session token can request URLs that contain relative path sequences (../) and read any file the authenticated Plex user can access. This includes the PlexOnlineToken, which grants full control of the Plex account and server. The flaw also permits a LAN‑adjacent attacker to supply a forged X‑Forwarded‑For header to bypass authentication checks, expanding the attack surface. The weakness is a classic file path traversal (CWE‑22) and can lead to unauthorized disclosure of sensitive data and remote takeover of the server.

The vulnerability affects Plex Media Server installations running any version before 1.43.3.10861. No other versions or products are listed as impacted.

The CVSS score of 7.1 indicates a high severity impact. Although no EPSS score is currently available, the existence of the flaw and its access via a session token suggests a realistic exploit potential. The vulnerability is not yet listed in the CISA KEV catalog, but the required authentication means it is more likely to be leveraged by attackers who have already compromised a Plex user’s credentials or by local attackers with network access.