Plex Media Server - SSRF
WAF rulehttp:exploitcve.CVE-2026-96655MITRE T1059cwe.CWE-918
- Version
- 0.1
- Name
- crowdsecurity/vpatch-CVE-2026-96655
Detects Plex Media Server transcode SSRF via an arbitrary URL in the path parameter.
Install with a top-level collection
1 collection include itsudo cscli collections install ZoeyVid/npmplusInstalls 5 parsers and 54 scenarios, via WAF - Virtual Patching.
View NPMplus →Installation
sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2026-96655Then reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/vpatch-CVE-2026-96655description: 'Detects Plex Media Server transcode SSRF via an arbitrary URL in the path parameter.'rules:- and:- zones:- URItransform:- urldecode- lowercasematch:type: containsvalue: '/video/:/transcode/universal'- zones:- ARGSvariables:- pathtransform:- urldecode- lowercasematch:type: containsvalue: '://'labels:type: exploitservice: httpconfidence: 3spoofable: 0behavior: 'http:exploit'label: 'Plex Media Server - SSRF'classification:- cve.CVE-2026-96655- attack.T1059- cwe.CWE-918
Installed on
Know where it runs
Sign in to see the Security Engines that run this waf rule, the version they run and whether it was modified locally.
Documentation
This rule provides virtual patching for CVE-2026-96655, an SSRF vulnerability in Plex Media Server, published on 2026-09-23, with a CVSS score of 5.3 (Medium). It is part of the Plex2Shell exploitation chain.
Detection: Detects requests to /video/:/transcode/universal whose path parameter is a URL (contains ://) instead of a library path.
Virtual patching mitigates exploitation attempts, but it does not fix the underlying vulnerability: upgrading Plex Media Server to 1.43.3.10861 or later is always recommended.