This vulnerability allows an authenticated user to send a request to the transcode endpoint that resolves an arbitrary 'video' path. The server treats the supplied path as a URL and performs a request to it, exposing internal or external resources. This can lead to data exfiltration, discovery of hidden services, or exploitation of other internal vulnerabilities. The weakness is identified as CWE‑918.

Plex Media Server versions prior to 1.43.3.10861 are susceptible. Only users with authentication credentials to the Plex interface can trigger the SSRF. No specific operating system or hardware constraints are listed.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, implying limited known exploitation. The attack requires an authenticated session, so privilege escalation or credential compromise is a prerequisite. Internally authenticated users can reach internal addresses, while external addresses are also possible, broadening the potential for lateral movement or data leakage.