Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-5740: Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.

CVE-2020-5740 · published 6 years ago

Summary

Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.

What to do

Update plex media_server to version 1.19.1.2701 or later.

Affected software

Vendor	Product	Affected versions
plex	media_server	< 1.19.1.2701 `cpe:2.3:a:plex:media_server::::::::`

Original advisory text

Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.

References

https://www.tenable.com/security/research/tra-2020-25 Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-427Uncontrolled Search Path Element

Timeline

Published22 Apr 2020

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-5740 · NVD

Track software like this

Free during beta