Plex Media Server transcoder SSRF via /video/:/transcode/universal path parameter

#!/usr/bin/env bash
# check_plex_cve2026_96655.sh — Detect Plex Media Server vulnerable to CVE-2026-96655 (Plex2Shell chain)
# Usage: bash check_plex_cve2026_96655.sh <PLEX_URL>
#   e.g. bash check_plex_cve2026_96655.sh http://192.168.1.50:32400
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PLEX_URL="${1:-}"
FIXED_MAJOR=1
FIXED_MINOR=43
FIXED_PATCH=3
FIXED_BUILD=10861

if [ -z "$PLEX_URL" ]; then
  echo "Usage: $0 <PLEX_URL>"
  echo "Example: $0 http://192.168.1.50:32400"
  exit 2
fi

# Strip trailing slash
PLEX_URL="${PLEX_URL%/}"

# Query the unauthenticated /identity endpoint
RESPONSE=$(curl -sk --max-time 10 "${PLEX_URL}/identity" 2>/dev/null) || {
  echo "UNKNOWN — could not connect to ${PLEX_URL}/identity"
  exit 2
}

# Extract version from XML response
VERSION=$(echo "$RESPONSE" | grep -oP 'version="[^"]+"' | head -1 | cut -d'"' -f2)

if [ -z "$VERSION" ]; then
  # Try JSON format
  VERSION=$(echo "$RESPONSE" | grep -oP '"version"\s*:\s*"[^"]+"' | head -1 | cut -d'"' -f4)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse Plex version from response"
  exit 2
fi

echo "Detected Plex Media Server version: ${VERSION}"

# Parse version: format is MAJOR.MINOR.PATCH.BUILD-hash
IFS='.-' read -r V_MAJOR V_MINOR V_PATCH V_BUILD V_REST <<< "$VERSION"

# Numeric comparison
VULN=0
if [ "$V_MAJOR" -lt "$FIXED_MAJOR" ] 2>/dev/null; then
  VULN=1
elif [ "$V_MAJOR" -eq "$FIXED_MAJOR" ] 2>/dev/null; then
  if [ "$V_MINOR" -lt "$FIXED_MINOR" ] 2>/dev/null; then
    VULN=1
  elif [ "$V_MINOR" -eq "$FIXED_MINOR" ] 2>/dev/null; then
    if [ "$V_PATCH" -lt "$FIXED_PATCH" ] 2>/dev/null; then
      VULN=1
    elif [ "$V_PATCH" -eq "$FIXED_PATCH" ] 2>/dev/null; then
      if [ "${V_BUILD:-0}" -lt "$FIXED_BUILD" ] 2>/dev/null; then
        VULN=1
      fi
    fi
  fi
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE — ${VERSION} is below fixed version 1.43.3.10861"
  echo "  CVE-2026-96655 (SSRF) and the full Plex2Shell RCE chain apply."
  echo "  Upgrade immediately: https://www.plex.tv/media-server-downloads/"
  exit 1
else
  echo "PATCHED — ${VERSION} is at or above fixed version 1.43.3.10861"
  exit 0
fi