Overview
At the intersection of entertainment and technology, Tautulli, a Python-based tool for monitoring and tracking Plex Media Server, has been identified to harbor a serious vulnerability (CVE-2025-58760). This vulnerability affects Tautulli version 2.15.3 and earlier and poses a significant risk to system security and data integrity. The issue rests on the `/image` API endpoint, which is susceptible to path traversal, allowing unauthenticated attackers to read arbitrary files from the server’s filesystem.
Vulnerability Summary
CVE ID: CVE-2025-58760
Severity: High (8.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tautulli | v2.15.3 and earlier
How the Exploit Works
The vulnerability lies in the `/image` API endpoint, used to serve static images from Tautulli’s data directory to its users. Since the endpoint can be accessed without authentication, it becomes a lucrative target for attackers. By exploiting the path traversal vulnerability, attackers can read arbitrary files from the application server’s filesystem, including the `tautulli.db` SQLite database and `config.ini` file. The former contains active JWT tokens, while the latter houses the hashed admin password, JWT token secret, and Plex Media Server token and connection details.
Once an attacker gets hold of these files, they can potentially crack the password or use a valid JWT token obtained from the database. This could lead to privilege escalation, enabling the attacker to gain administrative control over the application.
Conceptual Example Code
An attacker could craft a malicious request to exploit this vulnerability, as demonstrated in the conceptual example below:
GET /image/../../tautulli.db HTTP/1.1
Host: target.example.comMitigation
The best mitigation strategy against this vulnerability is to apply the vendor patch, available in Tautulli version 2.16.0. If it’s not possible to update immediately, employing a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) could serve as temporary mitigation. These systems can be configured to block or alert on suspicious requests that match path traversal patterns.
