CVE-2026-96651: Plex Media Server media agent url parameter path traversal
HoneyLabs honeypots recorded 193 probes matching CVE-2026-96651 from 27 distinct source IP addresses in the last 7 days, of which 193 on interactive sensors. Severity is rated high.
27 sources probed for CVE-2026-96651 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on 5 of the 7 days in this window. The busiest day was 2026-11-13, with 94. One address, 45.198.224.69, sent 46% of them. The largest source network was AS215925 (Vpsvault.host Ltd), with 46% of the probes from 1 address.
Request paths that identify it
- /system/agents/media/get?{{*}}..%2F..%2F{{*}}
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 45.198.224.69 | 88 | Vpsvault.host Ltd | United States |
| 178.17.240.162 | 47 | FlokiNET ehf | Iceland |
| 85.121.5.125 | 19 | Alexhost S.r.l. | Moldova |
| 43.212.155.51 | 4 | Amazon.com, Inc. | Taiwan |
| 52.221.11.166 | 4 | Amazon.com, Inc. | Singapore |
| 3.34.46.89 | 3 | Amazon.com, Inc. | South Korea |
| 43.203.138.54 | 3 | Amazon.com, Inc. | South Korea |
| 18.139.159.172 | 2 | Amazon.com, Inc. | Singapore |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS215925 | Vpsvault.host Ltd | 88 | 1 |
| AS200651 | FlokiNET ehf | 47 | 1 |
| AS16509 | Amazon.com, Inc. | 34 | 20 |
| AS200019 | Alexhost S.r.l. | 19 | 1 |
| AS16276 | OVH SAS | 2 | 1 |
| AS204044 | Packet Star Networks Limited | 2 | 2 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 92 |
| Iceland | 47 |
| Moldova | 19 |
| Singapore | 10 |
| South Korea | 7 |
| Japan | 5 |
Requests the interactive sensors answered
- GET /system/agents/media/get?guid=com.plexapp.agents.thetvdb%3A%2F%2F12345&mediaType=1&url=metadata%3A%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..…
- GET /system/agents/media/get?guid=com.plexapp.agents.thetvdb%3A%2F%2F12345&mediaType=1&url=metadata%3A%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..…
- GET /system/agents/media/get?url=..%2F..%2F..%2F..%2FLibrary%2FApplication%20Support%2FPlex%20Media%20Server%2FLogs%2FPlex%20Media%20Server.log
- GET /system/agents/media/get?url=..%2F..%2F..%2FLogs%2FPlex%20Media%20Server.log
HTTP client fingerprints
- b11cun062_80040012_0421ce22_x0e7a7092
- b11cun072_80040013_aee6d12e_x0e7a7092
- b11cun031_00040010_e62b6d85_x0e7a
CVE report
Open a specific CVE from the CVE tracker.