CVE-2026-49995

Tautulli versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious external image URL into this lookup table and trigger server-side fetches through an unauthenticated endpoint, turning an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget.

In Tautulli prior to version 2.17.2, the unauthenticated /auth/redirect endpoint strips forward slashes from the redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default HTTP_ROOT configuration this allows redirecting a user to an attacker-controlled external origin.

Tautulli prior to 2.17.2 in the import_config handler and the database_file branch of import_database joins the attacker-controlled filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR.

In Tautulli prior to version 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string using manual escaping that does not handle backslashes. A backslash-quote sequence can terminate the string, allowing an unauthenticated attacker to execute script in the Tautulli web context when an authenticated user follows a crafted link.

Tautulli versions prior to 2.17.1 do not enforce POST method on the `configUpdate` endpoint and lack anti-CSRF tokens. An attacker can trick a logged-in administrator into visiting a malicious page that submits a cross-site request, overwriting the admin username and password, leading to administrative interface takeover.

Tautulli is a monitoring tool for Plex Media Server. Prior to 2.17.1, the `log_js_errors` endpoint is accessible to any authenticated user, including guests. It writes attacker-controlled strings to the application log. The admin-only `logFile` view reads the log and embeds it into HTML without escaping, causing stored XSS. A guest can inject HTML/JavaScript that executes in an administrator's browser.

Tautulli prior to 2.17.1 is vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before setup wizard completion, all management endpoints are unauthenticated. An attacker can create a newsletter agent, point the template directory to a malicious SMB share with a Mako template, and trigger execution via the newsletter render endpoint.

Tautulli before version 2.17.1 has a path traversal vulnerability in the cache deletion endpoint. An authenticated attacker can delete directories outside the configured cache path, leading to data loss and service disruption. Fixed in version 2.17.1.