Tautulli EUVD-2026-34256

Exploitation requires a valid Tautulli API credential with at minimum low-privilege access (CVSS PR:L) - unauthenticated remote exploitation is not possible. The vulnerable cache deletion API endpoint must be network-reachable (CVSS AV:N), which is the case for any Tautulli instance exposed to the internet or an internal network without API-layer access controls. No non-default configuration or special feature flag is required - the cache deletion API is standard Tautulli functionality present in all pre-2.17.1 deployments. Factors that limit exploitation include: (1) the authentication requirement - an attacker must first obtain or brute-force a valid API key; (2) OS-level filesystem permissions on the Tautulli service account - only directories accessible to that process can be deleted; and (3) the attacker must know or enumerate valid target directory paths on the host to cause meaningful damage beyond the cache directory itself.

The CVSS 4.0 base score of 5.7 (Medium) reflects network-accessible exploitation (AV:N), low attack complexity (AC:L), no additional attack requirements (AT:N), low privilege requirement (PR:L), no user interaction (UI:N), high integrity impact on the vulnerable system (VI:H), and low availability impact (VA:L). Confidentiality impact is absent (VC:N), indicating this is a destructive rather than data-exfiltration vulnerability. The E:P exploitability supplemental metric elevates practical risk above the base score by confirming a proof-of-concept exists, lowering the skill barrier for exploitation. No EPSS score was supplied in the input data, so probabilistic exploitation likelihood cannot be quantified here. No CISA KEV listing exists, meaning confirmed active exploitation has not been reported. The PR:L authentication requirement is the primary limiting factor against opportunistic mass exploitation - however, Tautulli deployments with weak, shared, or leaked API keys reduce this barrier significantly. The high VI:H integrity impact combined with an existing POC makes this a meaningful priority for any internet-exposed Tautulli instance, despite the medium base score.

An attacker who possesses or has stolen a low-privilege Tautulli API key sends a crafted HTTP DELETE request to the cache deletion endpoint, embedding path traversal sequences (e.g., '../../var/lib/tautulli_data' or '../../etc') in the path parameter. The server processes the unsanitized input and deletes the specified directory outside the cache root, destroying configuration files, application data, or other critical directories accessible to the Tautulli process. A proof-of-concept exists (CVSS E:P), meaning this attack sequence has been demonstrated and does not require advanced exploitation skill.