CVE-2025-58760 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the `/image` API endpoint is used to serve static images from the application's data directory to users. This endpoint can be accessed without authentication, and its intended purpose is for server background images and icons within the user interface. Attackers can exfiltrate files from the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application. Version 2.16.0 contains a fix for the issue.
A path traversal vulnerability has been identified in Tautulli versions through 2.15.3. The issue resides in the '/image' API endpoint, which is accessible without authentication. This endpoint is intended to serve static images from the application's data directory for use in the user interface. However, due to insufficient input validation, unauthenticated attackers can manipulate the image path parameters to traverse the file system and read arbitrary files. Exploitation of this vulnerability could lead to the unauthorized access of sensitive information, such as the 'tautulli.db' SQLite database, which contains active JWT tokens, and the 'config.ini' file, which holds the hashed admin password, JWT token secret, and Plex Media Server connection details. If the admin password is cracked or a valid JWT token is available, an attacker could escalate privileges to gain administrative control over Tautulli.
Users can upgrade to Tautulli version 2.16.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tautulli tautulli | < 2.16.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | Initial Analysis | [email protected] |
| Sep 9, 2025 | New CVE Received | [email protected] |