Path Traversal Vulnerability in Tautulli for Plex Media Server
CVE-2026-40605

5.7MEDIUM

Key Information:

Vendor

Tautulli

Status
Tautulli
Vendor
CVE Published:
4 June 2026

What is CVE-2026-40605?

Tautulli, a monitoring tool for Plex Media Server, exhibits a path traversal vulnerability in its cache deletion endpoint. Prior to version 2.17.1, this vulnerability permits authenticated API users to delete directories beyond the configured cache path, leading to potential arbitrary data loss and disruption of services. The issue has been addressed in version 2.17.1, which enhances the security of the application.

Affected Version(s)

Tautulli < 2.17.1

References

https://github.com/Tautulli/Tautulli/security/advisories/...
x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
x_refsource_MISC

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.