CVE-2025-58762

Tautulli versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious external image URL into this lookup table and trigger server-side fetches through an unauthenticated endpoint, turning an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget.

In Tautulli prior to version 2.17.2, the unauthenticated /auth/redirect endpoint strips forward slashes from the redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default HTTP_ROOT configuration this allows redirecting a user to an attacker-controlled external origin.

Tautulli prior to 2.17.2 in the import_config handler and the database_file branch of import_database joins the attacker-controlled filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR.

In Tautulli prior to version 2.17.2, the newsletter cron field is inserted into a JavaScript string without safe JSON encoding. An administrator or a caller with the Tautulli API key can store a crafted cron value that executes script in the Tautulli web context when an administrator opens the newsletter configuration modal.

In Tautulli prior to version 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string using manual escaping that does not handle backslashes. A backslash-quote sequence can terminate the string, allowing an unauthenticated attacker to execute script in the Tautulli web context when an authenticated user follows a crafted link.

Tautulli versions prior to 2.17.1 do not enforce POST method on the `configUpdate` endpoint and lack anti-CSRF tokens. An attacker can trick a logged-in administrator into visiting a malicious page that submits a cross-site request, overwriting the admin username and password, leading to administrative interface takeover.

Tautulli is a monitoring tool for Plex Media Server. Prior to 2.17.1, the `log_js_errors` endpoint is accessible to any authenticated user, including guests. It writes attacker-controlled strings to the application log. The admin-only `logFile` view reads the log and embeds it into HTML without escaping, causing stored XSS. A guest can inject HTML/JavaScript that executes in an administrator's browser.

Tautulli prior to 2.17.1 is vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before setup wizard completion, all management endpoints are unauthenticated. An attacker can create a newsletter agent, point the template directory to a malicious SMB share with a Mako template, and trigger execution via the newsletter render endpoint.

Tautulli before version 2.17.1 has a path traversal vulnerability in the cache deletion endpoint. An authenticated attacker can delete directories outside the configured cache path, leading to data loss and service disruption. Fixed in version 2.17.1.

Tautulli v2.15.3 and prior contains a command injection vulnerability that allows attackers with administrative privileges to achieve remote code execution on the application server. The vulnerability exists when the application is cloned from GitHub and installed manually, as the `runGit` function in `versioncheck.py` uses `shell=True` in `subprocess.Popen` and user-supplied remote and branch names are not sanitized. The fix is in version 2.16.0.