Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a Server Side Request Forgery via the '/player/timeline' endpoint. An attacker who can supply an X‑Plex‑Token header can embed an arbitrary URL in the protocol parameter, causing the Plex server to perform a POST request to that destination. The vulnerability may allow access to internal network resources or external sites, potentially exposing data or enabling further exploitation. This flaw is a classic example of CWE‑918: Server‑Side Request Forgery.

All installations of Plex Media Server running a version earlier than 1.43.3.10861 are affected. No patched or higher versions are listed in the current data.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not listed in the CISA KEV registry. Based on the description, the attack will succeed if an attacker can supply the X‑Plex‑Token header and reach the vulnerable endpoint, which may require access to the Plex server or an authenticated client session. The flaw grants the attacker the ability to force the Plex server to send requests to arbitrary URLs, potentially exposing internal services or facilitating further attacks.