CVE-2014-9181

Plex Media Server <0.9.9.3 - Path Traversal

Title source: llm

Description

Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/.

Exploits (1)

exploitdb WRITEUP

webappsmultiple

https://www.exploit-db.com/exploits/31983

View Code ZIP pw:eip

References (3)

[Exploit] http://www.securityfocus.com/archive/1/531290

[Patch, Vendor Advisory] https://forums.plex.tv/index.php/topic/62832-plex-media-server/?p=583250

[Exploit] https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140228-1_Plex_Media_Server_Authentication_bypass_local_file_disclosure_v10.txt

Scores

EPSS 0.1530

EPSS Percentile 94.7%

Details

CWE

CWE-22

Status published

Products (1)

plex/media_server < 0.9.9.2

Published Dec 02, 2014

Tracked Since Feb 18, 2026