The vulnerability allows an authenticated user to send a request to the transcode endpoint that resolves an arbitrary "video" path. Plex Media Server treats the supplied path as a URL and performs a request to it, exposing internal or external resources. This can lead to data exfiltration, discovery of hidden services, or exploitation of other internal vulnerabilities. The weakness is identified as CWE-918.

Plex Media Server versions prior to 1.43.3.10861 are susceptible. Only users with authentication credentials to the Plex interface can trigger the SSRF. No specific operating system or hardware constraints are listed.

The CVSS score of 5.3 indicates moderate severity. An EPSS score of 11% indicates a moderate probability of exploitation, even though the vulnerability is listed in the CISA KEV catalog, suggesting known exploitation. The attack requires an authenticated session, so privilege escalation or credential compromise is a prerequisite. Internally authenticated users can reach internal addresses, while external addresses are also possible, broadening the potential for lateral movement or data leakage.