Detect Plex Media Server External Control of File Name or Path (CVE-2026-96656) in Splunk
Detects exploitation attempts against CVE-2026-96656, an external control of file name or path vulnerability (CWE-73) in Plex Media Server v1.43.2 and earlier. An attacker can manipulate file name or path parameters supplied to Plex Media Server HTTP endpoints to cause the service to read, write, or reference arbitrary files outside intended directories, enabling information disclosure or arbitrary file operations. This CVE is listed in CISA KEV, indicating confirmed in-the-wild exploitation. The detection surfaces path-traversal sequences, suspicious file/path parameters, and anomalous file access by the Plex Media Server process across network and host telemetry.
MITRE ATT&CK
- Tactic
- Initial Access Collection
SPL Detection Query
index=web OR index=proxy OR index=network (sourcetype="ms:iis:auto" OR sourcetype="iis" OR sourcetype="plex:access" OR dest_port=32400)
| eval combined=coalesce(uri, url, RequestURL, uri_path).coalesce(uri_query, "")
| regex combined="(?i)(\.\.\/|\.\.%2f|\.\.%252f|%2e%2e(\/|%2f|%5c)|\.\.\\|\.\.\.\.\/\/)"
| stats count AS request_count values(combined) AS sample_resources min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_port
| where request_count>=1
| sort - request_countFlags encoded and raw directory-traversal sequences against Plex Media Server endpoints (port 32400) in Splunk web/proxy/network logs, indicative of CVE-2026-96656 path-control exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Media folders legitimately named with dot sequences producing '..' substrings in requested paths
- Authorized security scanning tools generating traversal test payloads
- Proxy normalization re-encoding path separators into logged URLs
Other platforms for CVE-2026-96656
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Encoded path traversal against Plex library endpoint
Expected signal: Proxy/IIS/network logs record an inbound HTTP request to port 32400 with '..%2f' traversal sequences in the URI.
- Test 2 Double-encoded traversal in file parameter
Expected signal: Web/proxy logs capture an HTTP request to Plex with a '..%252f' double-encoded traversal in the path query parameter.
- Test 3 Raw dot-dot traversal via transcode endpoint
Expected signal: Network/proxy telemetry records an HTTP request to port 32400 containing literal '../' traversal in the path parameter.
References (4)
- https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-96656
Response Playbook
Triage
- Confirm the targeted host runs Plex Media Server and determine its version; versions v1.43.2 and earlier are vulnerable to CVE-2026-96656.
- Extract the full requested URL/path and decode any URL-encoding to determine the exact file or directory the attacker attempted to reference outside the media library.
- Correlate the source IP against known Plex clients and threat intelligence; determine whether the endpoint was reachable from the internet (default port 32400).
- Review the HTTP response codes and byte counts for the flagged requests to assess whether the traversal succeeded (200/206 with data returned) versus was rejected (403/404).
Containment
- Upgrade Plex Media Server to a fixed version (later than v1.43.2) per the Plex security advisory immediately.
- Block inbound access to TCP 32400 from untrusted networks and disable Plex Remote Access until patched.
- If compromise is suspected, isolate the host from the network and preserve the Plex service for forensic review.
Evidence Collection
- Collect Plex Media Server access and server logs (Plex Media Server/Logs/) covering the request window.
- Capture IIS/reverse-proxy and firewall logs showing the source IP, requested URIs, and response sizes for the traversal attempts.
- Snapshot or hash any files the attacker may have read or written (config, tokens, credential stores) referenced by the traversal path.
Escalation Criteria
- !Escalate to incident response if traversal requests returned data (2xx with non-trivial body) indicating successful file disclosure.
- !Escalate if evidence shows the Plex process accessed sensitive files outside the media library (e.g., Preferences.xml, OS credential or token stores) following the request.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Plex Media Server access logs under 'Plex Media Server/Logs/' showing traversal URIs and response sizes - >
Plex 'Preferences.xml' and token/database files whose access timestamps changed during the request window - >
IIS/reverse-proxy W3C logs and firewall flow records capturing the source IP and requested paths
Tuning Guidance
Baseline legitimate Plex client traffic and the media library's real directory names first, then suppress source IPs and paths matching known-good folders that literally contain dot-dot substrings. Prioritize alerts where traversal requests returned 2xx/206 with non-trivial byte counts, and raise confidence to high for internet-sourced IPs hitting port 32400. Decode URL encoding before matching to catch %2e%2e and double-encoded variants, and exclude authorized scanner source ranges.
Hunting Queries
Surfaces Plex-bound HTTP requests containing traversal sequences along with response status and byte counts to distinguish successful disclosure from blocked attempts.
W3CIISLog | where csUriQuery has_any ("path","file","url") | where csUriStem has_any ("../","%2e%2e") or csUriQuery has_any ("../","%2e%2e") | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, scBytes | order by TimeGenerated descindex=web OR index=proxy (dest_port=32400 OR uri=*/library*) | regex _raw="(?i)(\.\.\/|%2e%2e)" | table _time, src_ip, uri, status, bytes | sort - _timeAtomic Red Team Tests
Sends an HTTP request with an encoded directory-traversal sequence to the Plex Media Server library endpoint to simulate CVE-2026-96656 exploitation.
Command
curl -s -o /dev/null -w '%{http_code}\n' 'http://127.0.0.1:32400/library/parts/..%2f..%2f..%2f..%2fetc%2fpasswd?X-Plex-Token=test'Cleanup
echo 'No cleanup required; request is read-only'Expected Telemetry
Proxy/IIS/network logs record an inbound HTTP request to port 32400 with '..%2f' traversal sequences in the URI.
Expected Detection
The kql/spl/network queries flag the traversal payload against the Plex endpoint.
Issues a request with a double-encoded traversal sequence in a file/path parameter to test detection of obfuscated CVE-2026-96656 payloads.
Command
powershell -c "try { Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:32400/web/index.html?path=..%252f..%252f..%252fWindows%252fwin.ini' } catch { $_.Exception.Response.StatusCode.value__ }"Cleanup
Remove-Item -ErrorAction SilentlyContinue $nullExpected Telemetry
Web/proxy logs capture an HTTP request to Plex with a '..%252f' double-encoded traversal in the path query parameter.
Expected Detection
Queries matching %252f double-encoded sequences flag the request.
Sends a raw (unencoded) directory-traversal payload to the Plex transcode endpoint to exercise plain-text traversal detection.
Command
curl -s -o /dev/null -w '%{http_code}\n' 'http://127.0.0.1:32400/video/:/transcode/universal/start?path=../../../../etc/hosts'Cleanup
echo 'No cleanup required; request is read-only'Expected Telemetry
Network/proxy telemetry records an HTTP request to port 32400 containing literal '../' traversal in the path parameter.
Expected Detection
Queries matching raw '../' sequences against the Plex endpoint raise an alert.