Path Traversal Vulnerability in Tautulli by Tautulli
CVE-2026-52835

7HIGH

Key Information:

Vendor

Tautulli

Status
Tautulli
Vendor
CVE Published:
21 September 2026

What is CVE-2026-52835?

Tautulli, a monitoring tool for Plex Media Server, has a vulnerability in its import_config handler and import_database function that allows an attacker to manipulate file paths. By crafting a multipart filename with directory traversal sequences, an authorized caller can upload files outside the designated CACHE_DIR. This issue can lead to configuration tampering or unauthorized code execution. Version 2.17.2 addresses this vulnerability.

Affected Version(s)

Tautulli < 2.17.2

References

https://github.com/Tautulli/Tautulli/security/advisories/...
x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/commit/8c7c1a5ab09a6...
x_refsource_MISC
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.