BlackTreeIndependent security intelligencePlex · Media Server
CISA confirms exploitation in the wild and lists 2023-03-31 as the remediation due date.
CISA confirms exploitation in the wild and lists 2023-03-31 as the remediation due date.
Fix not verifiedPlex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Attacker-influenced serialised data is reconstructed as trusted objects, which can invoke dangerous application behaviour.
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may execute code or commands in the affected security context.
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
Attacker-influenced serialised data is reconstructed as trusted objects, which can invoke dangerous application behaviour.
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may execute code or commands in the affected security context.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2023-03-10.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-502: Deserialization of Untrusted Data. The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 8 May 2020 · Last source change 21 Oct 2025, 23:35 UTC · CWE-502 · Deserialization of Untrusted Data
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.