EUVD-2026-34284Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege/guest Tautulli account
-
DeliverySubmit malicious payload to log_js_errors endpoint
-
ExploitPayload persisted unsanitized in application log
-
ExecutionAdministrator opens logFile viewer
-
PersistStored XSS executes in admin browser
-
ImpactSteal admin session or invoke privileged APIs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Tautulli account - this can be a guest user, but only when the administrator has explicitly enabled guest access in Tautulli; otherwise a standard low-privilege user account is needed. The attack also requires user interaction from an administrator: an admin must subsequently open the administrator-only logFile viewer for the stored payload to execute. The vulnerable endpoint log_js_errors and the admin logFile view must both be reachable in the deployment, and the Tautulli instance must be running a version prior to 2.17.1. |
| Impact | The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L (8.9) reflects network reachability, low attack complexity, low-privilege authentication (a guest account suffices where guest access is enabled), required user interaction (an admin must open the log viewer), and a scope change yielding high confidentiality and integrity impact on the admin context. There is no EPSS score, KEV listing, or SSVC decision data in the provided input, and no public exploit identified at time of analysis - so realistic risk hinges on exposure of Tautulli instances to untrusted users (notably those running with guest access enabled or shared accounts). The CVSS-rated severity is genuinely meaningful for multi-tenant or internet-exposed deployments, but for single-admin home setups behind a LAN the practical risk is materially lower; treat this as a high-priority patch where guest access or shared logins are in use, and a standard patch otherwise. |
| Exploit ScenarioDerived | An attacker with a guest or low-privilege Tautulli account submits a crafted JavaScript error payload to the log_js_errors endpoint containing HTML/JS such as a script tag that exfiltrates the admin session cookie or invokes authenticated API actions. The payload is persisted into the main application log; when an administrator later opens the logFile view, the unescaped content executes in the admin's browser within the admin's session, enabling cookie theft, configuration changes, or further pivot into the linked Plex environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 04, 2026
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when guest access is enabled) to inject HTML/JavaScript into the main application log via the log_js_errors endpoint, which later executes in an administrator's browser when the admin opens the logFile viewer. The flaw enables privilege escalation against the Plex Media Server monitoring tool's admin account. No public exploit identified at time of analysis, but the vendor-published advisory and confirmed patch in 2.17.1 make the issue well-documented.
RemediationAI
Vendor-released patch: upgrade Tautulli to version 2.17.1 or later, which sanitizes JS log errors before they are written to the main application log (see https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 and advisory https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr). If immediate patching is not possible, disable guest access in Tautulli settings to remove the lowest-privilege attack surface (trade-off: guest users lose read-only visibility), restrict the Tautulli web UI to a trusted network or VPN to eliminate untrusted authenticated reach, and instruct administrators to avoid opening the log viewer until the upgrade is applied since admin browser interaction is required to fire the stored payload.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tautulli is a Python-based monitoring and tracking application for Plex Media Server (CPE cpe:2.3:a:tautulli:tautulli). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) realized as a stored XSS chain: the log_js_errors endpoint accepts attacker-controlled strings from any authenticated user and writes them verbatim into the main application log, while the administrator-only logFile view reads that log and embeds the content into an HTML response without HTML-escaping. Because the sink is the application log itself, any low-privilege user who can reach the endpoint can persistently taint admin-rendered output - a classic log-poisoning-into-XSS pattern.
Know when Tautulli gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose log_js_errors to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only logFile view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.
Executive ViewAI
Tautulli before version 2.17.1 contains a stored cross-site scripting vulnerability that allows low-privilege users (including guest accounts) to inject malicious code into application logs, which executes in administrators' browsers and enables privilege escalation against admin accounts. Organizations with Tautulli deployments that support guest access risk unauthorized administrative account compromise and exposure of Plex Media Server infrastructure. No public exploit identified at time of analysis.
Disable guest access until patch deployment. Vendor-released patch: Tautulli 2.17.1
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Path traversal in Tautulli's /newsletter/image/images API endpoint allows unauthenticated remote attackers to read arbit
Unauthenticated path traversal in Tautulli 2.15.3 and earlier allows remote attackers to read arbitrary files from the s
Path traversal in Tautulli 2.15.3 and earlier allows unauthenticated remote attackers to read arbitrary files through th
Remote code execution in Tautulli through 2.15.3 requires pre-existing administrative access: an attacker who can repoin
Command injection in Tautulli 2.15.3 and earlier lets an authenticated administrator achieve remote code execution on th
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Rated medium sever
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when cons
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the T
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Cross-site request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to hijack administrator accounts
Remote code execution in Tautulli (Python-based Plex Media Server monitoring tool) versions prior to 2.17.0 allows authe
Cross-site scripting (XSS) in Tautulli 1.3.10 through 2.16.x allows remote attackers to inject malicious scripts via uns
Exploit-DB