CVE-2026-40605 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.
A path traversal vulnerability has been identified in Tautulli versions prior to 2.17.1. This vulnerability exists in the cache deletion endpoint, where authenticated API users can manipulate the 'folder' parameter to delete directories outside the designated cache path. The issue arises because the input is not properly validated before being used to construct a filesystem path, leading to potential arbitrary data loss and disruption of service.
Users can update to Tautulli version 2.17.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-fg46-xx7h-mhwr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 | [email protected] | Release NotesVendor |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-fg46-xx7h-mhwr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tautulli | <= 2.17.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |