← Vulnerability feed

Vulnerability record · CVE-2014-9181 · published 2 December 2014

CVE-2014-9181: Plex media server path traversal vulnerability

Plex · Media Server

Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/.

5.0 CVSS 2.0 Medium EPSS 9.5% · top 4.7% CWE-22 · Path traversal
5.0CVSS 2.0 base score
9.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/archive/1/531290 Exploit
https://forums.plex.tv/index.php/topic/62832-plex-media-server/?p=583250 PatchVendor Advisory
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140228-1_Plex_Media_Server_Authentication_bypas Exploit
http://www.securityfocus.com/archive/1/531290 Exploit
https://forums.plex.tv/index.php/topic/62832-plex-media-server/?p=583250 PatchVendor Advisory
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140228-1_Plex_Media_Server_Authentication_bypas Exploit

Track CVE-2014-9181 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.2CVE-2020-5741Plex Media Server Windows deserialization leads to Python code executionPlex Media Server on Windows deserializes untrusted data, allowing a remote, authenticated attacker to execute arbitrary Python code. The flaw is a C…KEVEPSS 73%analysed9.8CVE-2018-13415Plex media server xml external entity (xxe) vulnerabilityIn Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.…EPSS 32%8.8CVE-2020-5742Plex media server vulnerabilityImproper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.EPSS 1.4%8.8CVE-2019-19141Plex media server path traversal vulnerabilityThe Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account r…EPSS 4.7%7.8CVE-2020-5740Plex media server uncontrolled search path element vulnerabilityImproper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privi…EPSS 0.75%7.5CVE-2021-33959Plex media server origin validation error vulnerabilityPlex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.EPSS 15%7.5CVE-2014-9304Plex media server permissions and access controls vulnerabilityPlex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrati…EPSS 8.1%7.1CVE-2025-69414Plex media server incorrect authorization vulnerabilityPlex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.EPSS 0.25%

Source: NIST National Vulnerability Database (record CVE-2014-9181), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.