Is there a patch available for CVE-2026-40605?

Yes, a patch is available for CVE-2026-40605. Update the affected software to the latest version immediately.

Tautulli CVE-2026-40605

Q: What is the CVSS score of CVE-2026-40605?

CVE-2026-40605 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34256 MEDIUM

Path Traversal (CWE-22)

2026-06-04 GitHub_M

Python Path Traversal Tautulli

5.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:22 vuln.today

Analysis Generated

Jun 04, 2026 - 16:22 vuln.today

Patch available

Jun 04, 2026 - 15:01 EUVD

CVSS changed

Jun 04, 2026 - 14:22 NVD

5.7 (MEDIUM)

CVE Published

Jun 04, 2026 - 12:50 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.

AnalysisAI

Path traversal in Tautulli's cache deletion API endpoint allows authenticated low-privilege users to delete arbitrary directories outside the configured cache root, resulting in arbitrary data loss and service disruption. All Tautulli versions prior to 2.17.1 are affected; the vendor-confirmed fix is v2.17.1 (released 2026-05-04). The CVSS 4.0 E:P modifier confirms proof-of-concept exploit code exists, and no public exploit identified at time of analysis rises to CISA KEV-confirmed active exploitation.

Technical ContextAI

Tautulli is a Python-based web application for monitoring and tracking Plex Media Server activity, exposing an HTTP API for management functions including cache operations. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the cache deletion API endpoint does not adequately sanitize or validate caller-supplied path parameters, allowing traversal sequences such as '../' to escape the intended cache directory boundary and reference arbitrary filesystem paths. The CPE string cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:* confirms the vulnerability spans all versions of the application up to the fix point. Because Tautulli runs as a persistent background service with its own filesystem identity, the scope of deletable directories is bounded only by the OS-level permissions granted to the Tautulli process, not by application-layer controls.

RemediationAI

Upgrade to Tautulli v2.17.1 or later, which directly fixes CVE-2026-40605 as confirmed in the official release changelog at https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 and the security advisory at https://github.com/Tautulli/Tautulli/security/advisories/GHSA-fg46-xx7h-mhwr. If immediate patching is not feasible, restrict network access to the Tautulli API using a firewall or reverse proxy to limit reachability to trusted IP addresses only - this reduces external attack surface but does not protect against malicious or compromised internal API key holders. Additionally, audit all issued API keys and revoke credentials for untrusted, unused, or broadly shared accounts, since exploitation requires authenticated access (PR:L). As a further compensating control, reduce the OS-level filesystem permissions of the Tautulli service account to the minimum required directories, which limits the blast radius of any successful traversal attempt without eliminating the vulnerability itself.