Tautulli CVE-2025-58760

No special conditions - remote unauthenticated path traversal against default configurations of Tautulli v2.15.3 and earlier, because the /image API endpoint is intentionally reachable without authentication to serve UI background images and icons. The only meaningful limiting factors are that the instance must be network-reachable to the attacker (typically internet-exposed or on an accessible network) and must be running a vulnerable version (≤2.15.3); the escalation-to-admin step additionally requires either that the admin password is crackable from its hash or that a valid JWT token is present in the exfiltrated database.

This is a genuine, actionable priority despite a moderate 7.5 (High) CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the source-code diff corroborates the root cause: the /image and real_pms_image_proxy handlers joined user input onto the data directory with no containment check until the is_subdir() guard was added in 2.16.0. The signals do diverge: EPSS is low (0.15%, 36th percentile), indicating no evidence of broad mass-exploitation volume, yet a public exploit exists via the GitHub Security Advisory (GHSA-8g4r-8f3f-hghp) and the fix commit plainly reveals the traversal, lowering the bar for weaponization. The low EPSS alongside available POC suggests opportunistic or targeted use rather than internet-wide automated campaigns at this time - consistent with the product's niche, largely internet-exposed-by-hobbyist deployment pattern. No SSVC decision data or KEV listing was provided, so active-exploitation status cannot be asserted. The impact is confidentiality-only (C:H, I:N, A:N) at the base metric, but the description credibly describes a chain: reading config.ini/tautulli.db yields the hashed admin password, JWT secret, active JWT tokens, and Plex token - enabling privilege escalation to admin, which is a real-world amplifier the base score does not capture.

An attacker locates an internet-exposed Tautulli instance (v2.15.3 or earlier) and sends crafted requests to the unauthenticated /image endpoint containing path-traversal sequences to read files outside the intended images directory. They exfiltrate config.ini and tautulli.db, recover the JWT secret, hashed admin password, and any active JWT tokens, then crack the password offline or forge/replay a token to gain administrative control. A public exploit is available via the vendor's GitHub Security Advisory, making this reproducible without original research.