Path Traversal Vulnerability in Tautulli for Plex Media Server

CVE-2025-58760

What is CVE-2025-58760?

Tautulli, a monitoring tool for Plex Media Server, has a path traversal vulnerability in the unsecured /image API endpoint. This flaw in versions 2.15.3 and earlier allows unauthenticated attackers to access sensitive files from the server's filesystem, including the tautulli.db database, which can expose active JWT tokens and other sensitive information. Attackers can potentially escalate their privileges to gain administrative access if they manage to crack the hashed admin password or retrieve valid JWT tokens.

References