A high-severity vulnerability has been identified in Plex Media Server (PMS), affecting versions from 1.41.7.x to 1.42.0.x.
The issue stems from improper input validation (CWE-20) and can be exploited remotely with low complexity, potentially leading to severe consequences.
Plex has released a fix in version 1.42.1 (1.42.1.10060 or later).

Product	Plex Media Server
Date	2025-08-28 09:40:30
Information	Fix Available

Technical Summary

The vulnerability (CVE-2025-34158) allows an attacker to exploit improper input validation within PMS.
It is exploitable remotely over the network, requires no user interaction, and may require low or no privileges depending on the attack path.

Potential Impact:
Exposure of sensitive data (loss of confidentiality)
Unauthorized modification of data (compromise of integrity)
Service disruption or potential remote code execution (risk to availability)

Due to the high exposure of Plex servers on the internet, exploitation attempts are considered highly likely.

Recommendations

1. Update immediately

• Update Plex Media Server to version 1.42.1 (or later).
• Ensure you are running at least 1.42.1.10060.

1. Reduce exposure

• Avoid exposing Plex Media Server directly to the internet.
• Limit access using firewalls, VPNs, or network segmentation.

1. Monitor systems

• Check server logs for any suspicious activity.
• Monitor for abnormal traffic to PMS endpoints.

1. Maintain security hygiene

• Regularly apply Plex updates as soon as they are released.
• Follow official Plex security advisories for any new mitigations.