Tautulli CVE-2026-52835

Requires an authenticated Tautulli administrator session or possession of the instance API key (PR:H) to reach the import_config or import_database (database_file branch) handlers in plexpy/webserve.py. The attacker must submit a multipart upload whose filename contains parent-directory ('../') segments; exploitation works against default configurations of affected Tautulli versions prior to 2.17.2, with no user interaction. LIMITING FACTORS: the required admin/API-key privilege sharply narrows the attacker population; the write is constrained to filesystem paths the Tautulli process itself is permitted to write, so impact depends on what writable, security-relevant paths (config/startup files) exist for that process. No such special feature toggle is needed beyond having import access.

This is a genuine but conditional integrity/availability risk rather than a trivial-to-exploit critical. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:N/VI:H/VA:H, base 7.0) is internally consistent with the description: network-reachable, low complexity, but requiring HIGH privileges - the caller must already be a Tautulli administrator or hold the instance API key. No CVSS 3.1 vector, EPSS score, KEV entry, or public POC was provided, so exploitation-probability signals are absent - no public exploit identified at time of analysis, and there is no evidence of active exploitation. The 'RCE' tag and the description's 'can enable ... code execution' are plausible (an attacker can overwrite files at paths the Tautulli process can write, which may include config or startup files), but code execution is a downstream, non-guaranteed consequence - the primary, directly-demonstrated impact is arbitrary file write leading to configuration tampering and service disruption, matching VC:N/VI:H/VA:H. The high privilege requirement (admin/API key) is the decisive limiting factor and keeps real-world priority moderate: this is mainly a post-authentication integrity escalation, not a mass-exploitable remote flaw. No conflicting signals were found; the main gap is the absence of EPSS/KEV/POC data to gauge exploitation likelihood.

An attacker who already possesses Tautulli administrator access or the instance API key sends a multipart config or database import request (import_config / import_database) with a crafted filename containing '../' parent-directory segments. Because the filename is joined to CACHE_DIR without basename reduction or a containment check, the upload is written or overwritten outside CACHE_DIR - at any path the Tautulli process can write - before content validation runs, enabling configuration tampering, service disruption, or potentially code execution. No public exploit code was identified, though the fix diff clearly reveals the vulnerable path-join.