code-zm / plex2shell

git clone https://github.com/code-zm/plex2shell.git

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

—

stars, 24h

+42

stars, 7 days · #1,054

+42

stars, 30 days · #6,974

★ total · +42% this week

forks · 0 open issues

Star history starts 2026-10-20; the chart appears after the second daily snapshot.

LanguagePython

LicenseGPL-3.0

Created2026-10-18 (2d ago)

Last push2d ago

Watchers0

OwnerUser

Links

GitHub: github.com/code-zm/plex2shell
Releases · Issues · Hacker News mentions

README excerpt

# plex2shell
Unauth RCE chain for Plex Media Server **
## Disclaimer
This tool is published for authorized security testing, academic research,
and defensive purposes only. Use it only against systems you own or have
explicit written permission to test. The authors are not responsible for
misuse or damage caused by this tool. Unauthorized access to computer
systems is illegal.
## CVEs
| CVE | Primitive |
| --- | --- |
| CVE-2026-96652 | Unauthenticated SSRF via `/player/timeline` `protocol=` |
| CVE-2026-96654 | Loopback pivot: dead auth guard + `searchOne` `identifier=` injection |
| CVE-2026-96655 | Owner-authed transcoder SSRF + arbitrary-path file write (`dump-yuv`) |
| CVE-2026-96656 | Code execution via unsigned codec `dlopen` in the Codecs set-dir |
## Prerequisites
- Python 3.8+, `ffmpeg`, `gcc` (or `x86_64-w64-mingw32-gcc` for Windows targets)
- Attacker host reachable from the target (media fetch + reverse shell)
## License
GPLv3