Plex Media Server External Control of File Name or Path (CVE-2026-96656)

let traversal = dynamic(["../","..%2f","..%252f","%2e%2e/","..\\","%2e%2e%5c","....//"]);
union isfuzzy=true
(
W3CIISLog
| where csUriStem has_any ("/library", "/media", "/photo", "/video", "/web", "/transcode") or csUriQuery has_any ("path", "file", "url", "download")
| where csUriStem has_any (traversal) or csUriQuery has_any (traversal)
| extend SourceIP = cIP, Resource = strcat(csUriStem, "?", csUriQuery), DestPort = sPort
),
(
CommonSecurityLog
| where DeviceVendor has "Plex" or DestinationPort in (32400)
| where RequestURL has_any (traversal)
| extend SourceIP = SourceIP, Resource = RequestURL, DestPort = DestinationPort
)
| summarize RequestCount = count(), SampleResources = make_set(Resource, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestPort
| where RequestCount >= 1
| order by RequestCount desc

index=web OR index=proxy OR index=network (sourcetype="ms:iis:auto" OR sourcetype="iis" OR sourcetype="plex:access" OR dest_port=32400)
| eval combined=coalesce(uri, url, RequestURL, uri_path).coalesce(uri_query, "")
| regex combined="(?i)(\.\.\/|\.\.%2f|\.\.%252f|%2e%2e(\/|%2f|%5c)|\.\.\\|\.\.\.\.\/\/)"
| stats count AS request_count values(combined) AS sample_resources min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_port
| where request_count>=1
| sort - request_count

any where (
  (event.category == "network" and destination.port == 32400 and
   (stringContains(url.original, "../") or stringContains(url.original, "..%2f") or stringContains(url.original, "%2e%2e") or stringContains(url.original, "..%5c")))
  or
  (event.category == "web" and
   (stringContains(url.path, "../") or stringContains(url.query, "..%2f") or stringContains(url.query, "%2e%2e")))
)

SELECT sourceip, destinationport, "URL" AS req_url, COUNT(*) AS request_count, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen FROM events WHERE (destinationport = 32400 OR LOWER("URL") LIKE '%/library%' OR LOWER("URL") LIKE '%/transcode%') AND ("URL" IMATCHES '.*(\.\./|\.\.%2f|\.\.%252f|%2e%2e(/|%2f|%5c)|\.\.\\).*') GROUP BY sourceip, destinationport, "URL" ORDER BY request_count DESC LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*proxy* OR _sourceCategory=*plex*
| where (dest_port = 32400) or (url matches "*/library*") or (url matches "*/transcode*")
| where url matches /(?i)(\.\.\/|\.\.%2f|\.\.%252f|%2e%2e(\/|%2f|%5c)|\.\.\\)/
| count as request_count, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, dest_port, url
| where request_count >= 1
| sort by request_count desc

rule plex_cve_2026_96656_path_traversal {
  meta:
    author = "Argus"
    description = "Plex Media Server external control of file name or path (CVE-2026-96656) traversal attempts"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      $e.target.port = 32400 or
      re.regex($e.target.url, `(?i)/library|/transcode|/media`)
    )
    re.regex($e.target.url, `(?i)(\.\./|\.\.%2f|\.\.%252f|%2e%2e(/|%2f|%5c)|\.\.\\)`)
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/^(DnsRequest|NetworkConnectIP4|HttpRequest)$/ OR (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ )
| (RemotePort=32400 OR LocalPort=32400 OR ImageFileName=/Plex Media Server\.exe$/i OR FileName=/Plex Media Server/i)
| HttpUri=/(?i)(\.\.\/|\.\.%2f|\.\.%252f|%2e%2e(\/|%2f|%5c)|\.\.\\)/
| groupBy([aid, RemoteAddressIP4, RemotePort], function=([count(as=request_count), collect([HttpUri])]))
| sort(request_count, order=desc)