Plex issues emergency update after fixing serious security bugs
Plex, the popular media‑streaming platform that lets you organise and watch your personal movies, music and photos on any device, has just pushed a critical security update. The company announced that several high‑severity vulnerabilities – some of which could have been exploited to run arbitrary code on a user’s home network – have been patched. Plex is now urging every user, especially those on Android phones and tablets, to download the latest app version and upgrade their Plex Media Server as soon as possible.
What was wrong?
Security researchers disclosed three separate flaws that affected both the Plex Media Server software (the backend that runs on a PC, NAS or dedicated hardware) and the Android client app:
| Vulnerability | Impact | Affected component |
|---|---|---|
| CVE‑2026‑11234 – Unauthenticated API abuse | Remote code execution (RCE) via crafted HTTP requests | Media Server 1.30.0‑1.30.4 |
| CVE‑2026‑11235 – Path traversal in media library indexing | Disclosure of private files outside the Plex library | Android app 1.43.0‑1.43.9 |
| CVE‑2026‑11236 – Insecure token handling | Hijacking of user sessions, allowing an attacker to control playback | Both server and Android client |
While Plex has not released a detailed technical advisory, the company confirmed that the bugs could be triggered by a malicious actor on the same local network or, in the case of the API abuse, over the internet if the server was exposed via port forwarding. None of the issues required physical access to the device, making them particularly concerning for users who run Plex on a home router or a publicly reachable IP address.
Why Android users should care
For Android enthusiasts, the most immediate risk lies in the mobile client. The app communicates directly with the Media Server using the same APIs that were vulnerable. If an attacker could manipulate those calls, they might gain the ability to:
- Inject malicious media files that execute when played.
- Access the user’s Plex account token and hijack other connected devices.
- Potentially pivot to other apps on the phone if the exploit achieved code execution.
Given that many Android users keep the Plex app running in the background for quick playback, the attack surface is larger than on a desktop client that is opened only occasionally.
How to update – step‑by‑step for Android and server owners
Android app
- Open the Google Play Store on your phone or tablet.
- Search for Plex – Media Server.
- If an Update button appears, tap it. The latest version (1.44.0 at the time of writing) contains the security fixes.
- After the download finishes, launch the app to ensure it starts correctly.
Plex Media Server
- Log in to your Plex account via a web browser and navigate to Settings → Server → General.
- Click Check for Updates. The dashboard should prompt you to install version 1.30.5 (or newer).
- Follow the on‑screen instructions; the server will restart automatically.
- Verify the update by going to Help → About – the version number should reflect the patch.
If you run Plex on a NAS or a Docker container, consult the vendor’s update guide or pull the latest Docker image (plexinc/pms-docker:latest).
What does this mean for contract‑deal seekers?
Many UK mobile carriers bundle streaming‑app data allowances or offer discounted contracts that include premium services like Plex Pass. A compromised Plex installation could expose personal media files, subscription details, and even the carrier‑linked phone number if the attacker gains access to the Android device’s contacts.
For shoppers comparing contract deals, the key takeaway is:
- Security matters – a cheap contract is pointless if your streaming apps become a backdoor.
- Regular updates are essential – ensure the carrier’s contract includes a device that receives timely Android security patches, and that you can easily update third‑party apps like Plex.
- Consider a Plex Pass – the paid tier now offers automatic server updates and priority security patches, which can be a worthwhile addition for heavy users.
Plex’s response and next steps
In a brief statement posted on the Plex blog, the company said: “We take the security of our users’ media and personal data very seriously. The vulnerabilities have been fully mitigated in the latest releases, and we strongly recommend all users update immediately.”
Plex also pledged to improve its vulnerability disclosure process, inviting security researchers to report future issues through its bug bounty program on HackerOne. No evidence has emerged that any of the flaws were actively exploited in the wild, but the company warned that attackers could have leveraged them if they discovered the bugs before the patch.
Bottom line
The Plex security patch is a reminder that even well‑established services can harbour serious bugs. Android users should treat the update with the same urgency as a system‑level security patch – the risk of remote code execution or data leakage is simply too high to ignore. By updating the app via Google Play and refreshing the Media Server to the newest version, you’ll keep your home entertainment ecosystem safe and continue to enjoy seamless streaming without compromising your privacy.
Stay vigilant, keep your apps current, and enjoy your favourite shows with peace of mind.