Tautulli
Monthly
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the Tautulli or Plex Media Server host into fetching arbitrary attacker-chosen URLs via the public `/image/<hash>` route. A low-privilege guest first seeds a malicious external URL into the `image_hash_lookup` table, after which any unauthenticated external user can trigger the SSRF by requesting the resulting hash. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-m6j6-rc2c-8vpm and a vendor patch in v2.17.1 confirm the issue.
Cross-site request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to hijack administrator accounts by tricking an authenticated admin into visiting a malicious page. The `/configUpdate` endpoint accepts state-changing requests without enforcing POST or validating anti-CSRF tokens, and because the session cookie uses SameSite=Lax it remains attached to top-level cross-site navigations. No public exploit identified at time of analysis, but the fix is explicitly called out in the v2.17.1 release notes.
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when guest access is enabled) to inject HTML/JavaScript into the main application log via the log_js_errors endpoint, which later executes in an administrator's browser when the admin opens the logFile viewer. The flaw enables privilege escalation against the Plex Media Server monitoring tool's admin account. No public exploit identified at time of analysis, but the vendor-published advisory and confirmed patch in 2.17.1 make the issue well-documented.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Cross-site scripting (XSS) in Tautulli 1.3.10 through 2.16.x allows remote attackers to inject malicious scripts via unsanitized JSONP callback parameters, enabling API key theft from authenticated users who click crafted links. The vulnerability requires social engineering (UI:A in CVSS) and affects the Plex monitoring tool's web interface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though the attack complexity is rated high (AC:H) suggesting practical exploitation requires specific conditions. GitHub security advisory indicates vendor-patched release available.
Path traversal in Tautulli's /newsletter/image/images API endpoint allows unauthenticated remote attackers to read arbitrary files from the server filesystem. Tautulli, a Python-based monitoring tool for Plex Media Server, is affected in all versions prior to 2.17.0. The vulnerability carries a CVSS 4.0 score of 8.7 with network attack vector, low complexity, and no authentication required (PR:N), enabling trivial exploitation for sensitive information disclosure. No active exploitation confirmed at time of analysis, though the unauthenticated nature and public disclosure significantly elevate real-world risk.
Remote code execution in Tautulli (Python-based Plex Media Server monitoring tool) versions prior to 2.17.0 allows authenticated administrators to bypass sandbox restrictions in notification templates via lambda expressions, enabling arbitrary Python code execution. The vulnerability exploits a flaw in the str_eval() sandbox implementation that only inspects outer code object names (co_names) while nested lambda code objects store attribute accesses in co_consts, evading security checks. CVSS 7.5 with high attack complexity and high privilege requirement (PR:H) indicates limited real-world risk scope, with no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in Tautulli, the Python-based monitoring and tracking tool for Plex Media Server, affects all releases prior to 2.17.2 through the /search endpoint, which weaves the user-supplied query parameter into a JavaScript string. An unauthenticated attacker can craft a link that, once followed by an already-authenticated Tautulli user, executes arbitrary script inside that user's browser session on the Tautulli origin (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The flaw requires victim interaction and is confined to the Tautulli web context; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.17.2.
Stored cross-site scripting in Tautulli versions prior to 2.17.2 allows a caller who already holds Tautulli administrator privileges or a valid Tautulli API key to persist crafted JavaScript inside the newsletter 'cron' field, which is then executed in the browser of an administrator who simply opens the newsletter configuration modal. The payload is stored in the newsletters table and keeps firing after API-key or credential rotation until the affected newsletter entry is manually deleted, giving the flaw a persistence property that outlives routine remediation. Exploitation requires high privilege to plant the value and a separate administrator interaction to trigger it, so no public exploit code has been identified and the practical risk is low; both the upstream advisory and the vendor release v2.17.2 confirm this is a genuine but low-urgency issue rather than a remotely exploitable, unauthenticated attack.
Open redirect in Tautulli prior to 2.17.2 lets an unauthenticated attacker redirect a victim off-site via the /auth/redirect endpoint, enabling phishing and post-login redirect-flow abuse; the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is needed but the victim must click a crafted link. Only instances running the default root HTTP_ROOT configuration are exploitable - deployments with a custom non-root HTTP_ROOT path prefix are not affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-severity, low-priority targeted-phishing risk rather than a mass-exploitation threat; a vendor-released patch is available in 2.17.2.
Path traversal in Tautulli's cache deletion API endpoint allows authenticated low-privilege users to delete arbitrary directories outside the configured cache root, resulting in arbitrary data loss and service disruption. All Tautulli versions prior to 2.17.1 are affected; the vendor-confirmed fix is v2.17.1 (released 2026-05-04). The CVSS 4.0 E:P modifier confirms proof-of-concept exploit code exists, and no public exploit identified at time of analysis rises to CISA KEV-confirmed active exploitation.
SQL injection in Tautulli's /api/v2?cmd=get_home_stats endpoint allows authenticated administrators to exfiltrate sensitive data from the SQLite database via boolean-blind SQL inference. Affected versions include 2.14.2-2.16.x for the 'before' and 'after' parameters, and 2.1.0-beta-2.16.x for 'section_id' and 'user_id' parameters. The vulnerability requires possession of the admin API key and results in confidentiality compromise without code execution. Patch is available in version 2.17.0.
Server-Side Request Forgery (SSRF) in Tautulli prior to version 2.17.0 allows remote attackers to forge outbound HTTP requests from the Plex Media Server process via the unauthenticated /pms_image_proxy endpoint, potentially exposing internal services on RFC-1918 address space and enabling reconnaissance or attacks against systems accessible from the Plex server's network context.
Command injection in Tautulli 2.15.3 and earlier lets an authenticated administrator achieve remote code execution on the application server, but only when the instance was installed by manually cloning the GitHub repository so that the git-based update and versioning code path is live. The flaw lies in the checkout_git_branch endpoint, which persists attacker-controlled GIT_REMOTE and GIT_BRANCH values without sanitization and later interpolates them into a shell command executed with shell=True, so `$()` payloads run as the Tautulli process user. Publicly available exploit code exists, though EPSS is low at 0.37% (59th percentile) and there is no CISA KEV entry; the requirement for administrative credentials plus a non-default manual-git deployment keeps exposure narrow. Version 2.16.0 contains the fix.
Remote code execution in Tautulli through 2.15.3 requires pre-existing administrative access: an attacker who can repoint the configured Plex Media Server URL to a server they control can abuse the pms_image_proxy endpoint to write an arbitrary Python file via path traversal in the unsanitized img_format parameter, then execute it through the built-in Script notification agent. Publicly available exploit code exists, and the vendor fixed the issue in 2.16.0; EPSS is 0.61% (70th percentile). Because CVSS PR:H confirms the admin prerequisite, realistic exposure is limited to compromised admin credentials, malicious operators, or over-shared admin consoles rather than unauthenticated remote attackers.
Path traversal in Tautulli 2.15.3 and earlier allows unauthenticated remote attackers to read arbitrary files through the real_pms_image_proxy endpoint, including the tautulli.db SQLite database and config.ini secrets; publicly available exploit code exists, and stolen JWT tokens or cracked admin password hashes can enable administrative takeover. The CVSS vector confirms network access with no privileges or user interaction, though EPSS is low at 0.12%.
Unauthenticated path traversal in Tautulli 2.15.3 and earlier allows remote attackers to read arbitrary files from the server through the /image API endpoint, including tautulli.db and config.ini. Exfiltrating those files can expose active JWT tokens, the hashed admin password, the JWT token secret, and Plex Media Server credentials, potentially enabling escalation to administrative control if a token is valid or the password hash is cracked. Publicly available exploit code exists, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High); no confirmed active exploitation (CISA KEV) is indicated, and EPSS is low at 0.15%.
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the Tautulli or Plex Media Server host into fetching arbitrary attacker-chosen URLs via the public `/image/<hash>` route. A low-privilege guest first seeds a malicious external URL into the `image_hash_lookup` table, after which any unauthenticated external user can trigger the SSRF by requesting the resulting hash. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-m6j6-rc2c-8vpm and a vendor patch in v2.17.1 confirm the issue.
Cross-site request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to hijack administrator accounts by tricking an authenticated admin into visiting a malicious page. The `/configUpdate` endpoint accepts state-changing requests without enforcing POST or validating anti-CSRF tokens, and because the session cookie uses SameSite=Lax it remains attached to top-level cross-site navigations. No public exploit identified at time of analysis, but the fix is explicitly called out in the v2.17.1 release notes.
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when guest access is enabled) to inject HTML/JavaScript into the main application log via the log_js_errors endpoint, which later executes in an administrator's browser when the admin opens the logFile viewer. The flaw enables privilege escalation against the Plex Media Server monitoring tool's admin account. No public exploit identified at time of analysis, but the vendor-published advisory and confirmed patch in 2.17.1 make the issue well-documented.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Cross-site scripting (XSS) in Tautulli 1.3.10 through 2.16.x allows remote attackers to inject malicious scripts via unsanitized JSONP callback parameters, enabling API key theft from authenticated users who click crafted links. The vulnerability requires social engineering (UI:A in CVSS) and affects the Plex monitoring tool's web interface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though the attack complexity is rated high (AC:H) suggesting practical exploitation requires specific conditions. GitHub security advisory indicates vendor-patched release available.
Path traversal in Tautulli's /newsletter/image/images API endpoint allows unauthenticated remote attackers to read arbitrary files from the server filesystem. Tautulli, a Python-based monitoring tool for Plex Media Server, is affected in all versions prior to 2.17.0. The vulnerability carries a CVSS 4.0 score of 8.7 with network attack vector, low complexity, and no authentication required (PR:N), enabling trivial exploitation for sensitive information disclosure. No active exploitation confirmed at time of analysis, though the unauthenticated nature and public disclosure significantly elevate real-world risk.
Remote code execution in Tautulli (Python-based Plex Media Server monitoring tool) versions prior to 2.17.0 allows authenticated administrators to bypass sandbox restrictions in notification templates via lambda expressions, enabling arbitrary Python code execution. The vulnerability exploits a flaw in the str_eval() sandbox implementation that only inspects outer code object names (co_names) while nested lambda code objects store attribute accesses in co_consts, evading security checks. CVSS 7.5 with high attack complexity and high privilege requirement (PR:H) indicates limited real-world risk scope, with no public exploit identified at time of analysis.
Reflected cross-site scripting (CWE-79) in Tautulli, the Python-based monitoring and tracking tool for Plex Media Server, affects all releases prior to 2.17.2 through the /search endpoint, which weaves the user-supplied query parameter into a JavaScript string. An unauthenticated attacker can craft a link that, once followed by an already-authenticated Tautulli user, executes arbitrary script inside that user's browser session on the Tautulli origin (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The flaw requires victim interaction and is confined to the Tautulli web context; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.17.2.
Stored cross-site scripting in Tautulli versions prior to 2.17.2 allows a caller who already holds Tautulli administrator privileges or a valid Tautulli API key to persist crafted JavaScript inside the newsletter 'cron' field, which is then executed in the browser of an administrator who simply opens the newsletter configuration modal. The payload is stored in the newsletters table and keeps firing after API-key or credential rotation until the affected newsletter entry is manually deleted, giving the flaw a persistence property that outlives routine remediation. Exploitation requires high privilege to plant the value and a separate administrator interaction to trigger it, so no public exploit code has been identified and the practical risk is low; both the upstream advisory and the vendor release v2.17.2 confirm this is a genuine but low-urgency issue rather than a remotely exploitable, unauthenticated attack.
Open redirect in Tautulli prior to 2.17.2 lets an unauthenticated attacker redirect a victim off-site via the /auth/redirect endpoint, enabling phishing and post-login redirect-flow abuse; the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is needed but the victim must click a crafted link. Only instances running the default root HTTP_ROOT configuration are exploitable - deployments with a custom non-root HTTP_ROOT path prefix are not affected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-severity, low-priority targeted-phishing risk rather than a mass-exploitation threat; a vendor-released patch is available in 2.17.2.
Path traversal in Tautulli's cache deletion API endpoint allows authenticated low-privilege users to delete arbitrary directories outside the configured cache root, resulting in arbitrary data loss and service disruption. All Tautulli versions prior to 2.17.1 are affected; the vendor-confirmed fix is v2.17.1 (released 2026-05-04). The CVSS 4.0 E:P modifier confirms proof-of-concept exploit code exists, and no public exploit identified at time of analysis rises to CISA KEV-confirmed active exploitation.
SQL injection in Tautulli's /api/v2?cmd=get_home_stats endpoint allows authenticated administrators to exfiltrate sensitive data from the SQLite database via boolean-blind SQL inference. Affected versions include 2.14.2-2.16.x for the 'before' and 'after' parameters, and 2.1.0-beta-2.16.x for 'section_id' and 'user_id' parameters. The vulnerability requires possession of the admin API key and results in confidentiality compromise without code execution. Patch is available in version 2.17.0.
Server-Side Request Forgery (SSRF) in Tautulli prior to version 2.17.0 allows remote attackers to forge outbound HTTP requests from the Plex Media Server process via the unauthenticated /pms_image_proxy endpoint, potentially exposing internal services on RFC-1918 address space and enabling reconnaissance or attacks against systems accessible from the Plex server's network context.
Command injection in Tautulli 2.15.3 and earlier lets an authenticated administrator achieve remote code execution on the application server, but only when the instance was installed by manually cloning the GitHub repository so that the git-based update and versioning code path is live. The flaw lies in the checkout_git_branch endpoint, which persists attacker-controlled GIT_REMOTE and GIT_BRANCH values without sanitization and later interpolates them into a shell command executed with shell=True, so `$()` payloads run as the Tautulli process user. Publicly available exploit code exists, though EPSS is low at 0.37% (59th percentile) and there is no CISA KEV entry; the requirement for administrative credentials plus a non-default manual-git deployment keeps exposure narrow. Version 2.16.0 contains the fix.
Remote code execution in Tautulli through 2.15.3 requires pre-existing administrative access: an attacker who can repoint the configured Plex Media Server URL to a server they control can abuse the pms_image_proxy endpoint to write an arbitrary Python file via path traversal in the unsanitized img_format parameter, then execute it through the built-in Script notification agent. Publicly available exploit code exists, and the vendor fixed the issue in 2.16.0; EPSS is 0.61% (70th percentile). Because CVSS PR:H confirms the admin prerequisite, realistic exposure is limited to compromised admin credentials, malicious operators, or over-shared admin consoles rather than unauthenticated remote attackers.
Path traversal in Tautulli 2.15.3 and earlier allows unauthenticated remote attackers to read arbitrary files through the real_pms_image_proxy endpoint, including the tautulli.db SQLite database and config.ini secrets; publicly available exploit code exists, and stolen JWT tokens or cracked admin password hashes can enable administrative takeover. The CVSS vector confirms network access with no privileges or user interaction, though EPSS is low at 0.12%.
Unauthenticated path traversal in Tautulli 2.15.3 and earlier allows remote attackers to read arbitrary files from the server through the /image API endpoint, including tautulli.db and config.ini. Exfiltrating those files can expose active JWT tokens, the hashed admin password, the JWT token secret, and Plex Media Server credentials, potentially enabling escalation to administrative control if a token is valid or the password hash is cracked. Publicly available exploit code exists, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High); no confirmed active exploitation (CISA KEV) is indicated, and EPSS is low at 0.15%.
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.