Tautulli CVE-2025-58761

Exploitation requires network access to the Tautulli web interface and that the target runs v2.15.3 or earlier; no authentication, user interaction, or non-default configuration is needed (PR:N/UI:N), and the vulnerable real_pms_image_proxy endpoint is part of the standard application. The specific prerequisite is reaching that endpoint with an img parameter crafted to begin with the required 'interfaces/default/images' prefix and then include path-traversal characters to escape the intended directory. Limiting factors: the instance must be reachable by the attacker (many deployments sit on a LAN, behind a VPN, or behind an authenticating reverse proxy, which blocks direct access), and the follow-on admin takeover additionally depends on cracking the hashed admin password or finding a still-valid JWT token in the exfiltrated database.

Multiple signals must be weighed here. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact only (C:H/I:N/A:N), scoring 7.5 - consistent with an arbitrary-file-read path traversal that leaks sensitive data but does not directly alter or crash the system. A public exploit exists (the GitHub Security Advisory GHSA-r732-m675-wj7w details the bypass), which raises practical risk. However, the EPSS score is low at 0.12% (32nd percentile), and the CVE is NOT on the CISA KEV list, so there is no evidence of active, widespread exploitation at time of analysis. These signals are not truly conflicting: the low EPSS reflects the product's limited, mostly self-hosted/home-lab footprint rather than low technical exploitability - the vulnerability itself is trivially exploitable once an instance is reachable. The most important nuance is that confidentiality impact understates the practical consequence: the description shows the read primitive exposes config.ini (hashed admin password, JWT secret, Plex token) and tautulli.db (active JWT tokens), enabling a chain to full administrative takeover. So while the raw CVSS caps I/A at None, the realistic end-state is account compromise. Priority is elevated for any internet-exposed Tautulli instance but tempered for the many instances behind LAN/VPN/reverse-proxy auth. No SSVC decision data was provided in the input.

An attacker who can reach a Tautulli web instance (v2.15.3 or prior) sends an unauthenticated request to the real_pms_image_proxy endpoint with an img parameter that starts with the allowed 'interfaces/default/images' prefix and then appends path-traversal sequences to escape the directory and read config.ini and tautulli.db. Having exfiltrated the hashed admin password, JWT secret, and any active JWT tokens, the attacker cracks the password or replays/forges a token to gain full administrative control. A public exploit/advisory describing this bypass exists.