Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated arbitrary file read via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path traversal file read CVE-2025-58760 / CVE-2025-58761.""" import re from...

Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated path traversal via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. Presence also indicates related authenticated RCE issues CVE-2025-58762/58763. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path...

Tautulli <= 2.16.1 - Path Traversal

Unauthenticated LFI via /newsletter/image/images reads config.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli = 2.16.1 - Path Traversal""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Tautulli = 2.16.1 -...

CVE-2026-31831

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has be...

CVE-2026-31831 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has be...

CVE-2026-31831: Relative Path Traversal

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has be...

CVE-2018-19557

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...