High severity · published Dec 19, 2019
CVE-2019-19141
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server…
8.8
CVSS
4.7%
EPSS
No
On KEV
Description
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Media Server · Plex
through 1.18.2.2029 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19141
Vendor Advisory
https://forums.plex.tv/t/security-camera-upload/507289
More from Media Server
7.2
CVE-2026-96656
Plex Media Server arbitrary file write
7.2
CVE-2020-5741
Plex Media Server Remote Code Execution Vulnerability
6.5
CVE-2026-96654
Plex Media Server URL injection
4.3
CVE-2026-96655
Plex Media Server arbitrary-host SSRF
4.3
CVE-2026-96652
Plex Media Server SSRF