Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated path traversal via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. Presence also indicates related authenticated RCE issues CVE-2025-58762/58763. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path...

Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated arbitrary file read via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path traversal file read CVE-2025-58760 / CVE-2025-58761.""" import re from...

CVE-2026-31804 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...

CVE-2026-31804: Server-Side Request Forgery (SSRF)

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...

CVE-2025-58762

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the "pmsimageproxy" endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when...

CVE-2025-58762: External Control of File Name or Path

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the pmsimageproxy endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when...