What is the fix for CVE-2020-5741?

Apply the vendor update for Plex Media Server; the sources do not name the fixed version. CISA lists this as a known exploited vulnerability with required action: apply updates per vendor instructions.

Who is not affected by CVE-2020-5741?

Not affected if: camera-upload-disabled, no-admin-account-exposure.

Live › vulnerability › CVE-2020-5741

Go to dashboard

high7.2Exploited in the wildRuntime

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute…

Plex Media Server has a remote code execution flaw in its Camera Upload feature. An attacker who holds the server administrator's Plex account can upload a malicious file and get the server to execute it.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.2

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: May 8, 2020 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 10, 2023.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: internet.
Worst case: Attacker runs code on the Plex server via uploaded file.
CVSS said: 7.2. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2020-5741

Go to dashboard

high7.2Exploited in the wildRuntime

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.2

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: May 8, 2020 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 10, 2023.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: internet.
Worst case: Attacker runs code on the Plex server via uploaded file.
CVSS said: 7.2. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
plex media server	vendor	< 1.19.3	1.19.3
Plex Media Server	vendor	–	–

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute…

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute…

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources