XSS Vulnerability in Tautulli Monitoring Tool for Plex Media Server

CVE-2026-45381

What is CVE-2026-45381?

Tautulli, a monitoring tool for Plex Media Server, suffers from a Cross-Site Scripting (XSS) vulnerability due to inadequate handling of user inputs in the /search endpoint. The system fails to correctly escape backslashes within a user-controlled query parameter, potentially allowing an unauthenticated attacker to craft a malicious link. When followed by an authenticated user, this link can execute arbitrary scripts in the Tautulli web context. This issue is mitigated in version 2.17.2 and highlights the importance of robust input validation in web applications.

References