PT-2025-34216 · Plex · Plex Media Server

Luis Finke · Published 2025-08-21 · Updated 2026-02-27 · CVE-2025-34158

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plex Media Server versions 1.41.7.x through 1.42.0.x

Description Plex Media Server (PMS) versions 1.41.7.x through 1.42.0.x are affected by an unspecified security vulnerability reported through Plex’s bug bounty program. Over 300,000 instances remain vulnerable to remote exploitation. The vulnerability has a maximum CVSS score, indicating a critical severity.

Recommendations Update Plex Media Server to version 1.42.1.10060+ to resolve this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-669

CWE-20

Related Identifiers

CVE-2025-34158

Affected Products

Plex Media Server

References · 47

• 🔥 https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md · Exploit
• 🔥 https://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34158 · Security Note
• https://plex.tv/media-server-downloads · Patch
• https://twitter.com/helpnetsecurity/status/1960668314201444640 · Twitter Post
• https://t.me/cveNotify/153505 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1myrps8/top_10_trending_cves_24082025 · Reddit Post
• https://twitter.com/Prevent_Cyber/status/1963142417475047505 · Twitter Post
• https://t.me/CVEtracker/30581 · Telegram Post
• https://twitter.com/HunterMapping/status/1958815568514998321 · Twitter Post
• https://t.me/cveNotify/153506 · Telegram Post
• https://reddit.com/r/TechNadu/comments/1n2cuad/300k_plex_media_servers_still_vulnerable_to · Reddit Post
• https://twitter.com/Komodosec/status/1972062330839355406 · Twitter Post
• https://t.me/CVEtracker/31090 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1961230525160456547 · Twitter Post