Tautulli vulnerabilities
We track 12 vulnerabilities in Tautulli products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Tautulli vulnerabilities
- 7.0 High severity
Tautulli: Improper Limitation of a Pathname to a Restricted Directory
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.f
- 9.9 Critical severity
Tautulli: Server-Side Request Forgery
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through the same server-side image
- 8.8 High severity
Tautulli: Cross-Site Request Forgery
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default
- 8.9 High severity
Tautulli: Improper Neutralization of Input During Web Page Generation
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings direct
- 8.9 High severity
Tautulli: Improper Neutralization of Special Elements Used in a Template Engine
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all m
- 7.4 High severity
Tautulli: Improper Neutralization of Input During Web Page Generation
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version
- 7.5 High severity
Tautulli: Relative Path Traversal
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application s
- 10.0 Critical severity
Tautulli: Improper Control of Generation of Code
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable
- 7.2 High severity
Tautulli: Improper Neutralization of Special Elements used in an OS Command
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulne
- 7.2 High severity
Tautulli: External Control of File Name or Path
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. Thi
- 7.5 High severity
Tautulli: Path Traversal: 'dir/../../filename'
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application se
- 7.5 High severity
Tautulli: Relative Path Traversal
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's f