Tautulli EUVD-2026-84070

Reflected XSS reachable via the /search endpoint of Tautulli versions prior to 2.17.2 in default configuration - no special feature toggle or non-default setting is required on the server side. Exploitation is LIMITED by requiring victim interaction (UI:A): an already-authenticated Tautulli user must follow the attacker's crafted link for the script to execute in the web context. The attacker themselves needs no authentication (PR:N) to craft and deliver the link, but the flaw yields nothing without a logged-in victim who clicks it, and its impact is confined to the Tautulli browser origin.

This is a genuine but modest-severity reflected cross-site scripting flaw (CWE-79) in Tautulli's /search endpoint, where the user-controlled query parameter is inserted into a JavaScript string with manual escaping that neutralizes quotes and forward slashes but not backslashes - a backslash-quote sequence breaks out of the string and injects script. Vendor CVSS 4.0 scores it 5.1 (MEDIUM): AV:N/AC:L/AT:N make it network-reachable and easy to trigger, but UI:A means it requires an authenticated user to actively follow the attacker's crafted link, and impact is limited to SC:L/SI:L with no confidentiality/integrity impact on the vulnerable system itself (VC:N/VI:N/VA:N). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - this is 'no public exploit identified at time of analysis.' The exploit-vs-active-exploitation distinction matters: nothing here indicates in-the-wild use. The signals are internally consistent (a phishing-style reflected XSS requiring victim interaction against a niche self-hosted product), so this is a moderate-priority patch rather than an emergency - driven by the low deployment footprint and the mandatory authenticated-victim click, not by any exploitation evidence.

An attacker crafts a malicious Tautulli /search URL whose query parameter contains a backslash-quote sequence that terminates the JavaScript string and appends attacker script. The attacker sends this link to an authenticated Tautulli user (e.g. via phishing); when the victim clicks it, the script executes in the Tautulli web origin, allowing session/CSRF-token theft or actions in the victim's authenticated context. No public exploit code is identified, though the escaping bypass is straightforward to reproduce from the patch diff.