{"id":75992,"date":"2025-09-19T08:00:25","date_gmt":"2025-09-19T08:00:25","guid":{"rendered":""},"modified":"2025-10-14T17:55:25","modified_gmt":"2025-10-14T23:55:25","slug":"cve-2025-58760-path-traversal-vulnerability-in-tautulli-s-image-api-endpoint","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-58760-path-traversal-vulnerability-in-tautulli-s-image-api-endpoint\/","title":{"rendered":"CVE-2025-58760: Path Traversal Vulnerability in Tautulli\u2019s `\/image` API Endpoint<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

At the intersection of entertainment and technology, Tautulli, a Python-based tool for monitoring and tracking Plex Media Server, has been identified to harbor a serious vulnerability (CVE-2025-58760). This vulnerability affects Tautulli version 2.15.3 and earlier and poses a significant risk to system security and data integrity. The issue rests on the `\/image` API endpoint, which is susceptible to path traversal, allowing unauthenticated attackers to read arbitrary files<\/a> from the server’s filesystem.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-58760
\nSeverity: High (8.6 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Tautulli | v2.15.3<\/a> and earlier<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the `\/image` API<\/a> endpoint, used to serve static images from Tautulli’s data directory to its users. Since the endpoint can be accessed without authentication, it becomes a lucrative target for attackers. By exploiting the path traversal vulnerability, attackers can read arbitrary files<\/a> from the application server’s filesystem, including the `tautulli.db` SQLite database and `config.ini` file. The former contains active JWT tokens, while the latter houses the hashed admin password, JWT token secret<\/a>, and Plex Media Server token and connection details.
\nOnce an attacker gets hold of these files, they can potentially crack the password or use a valid JWT token obtained from the database<\/a>. This could lead to privilege escalation<\/a>, enabling the attacker to gain administrative control over the application.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker could craft a malicious request to exploit this vulnerability<\/a>, as demonstrated in the conceptual example below:<\/p>\n

GET \/image\/..\/..\/tautulli.db HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n
Mitigation<\/strong><\/p>\n
The best mitigation strategy against this vulnerability is to apply the vendor patch, available in Tautulli version 2.16.0. If it’s not possible to update immediately, employing a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) could serve as temporary mitigation. These systems can be configured to block or alert on suspicious requests that match path traversal<\/a> patterns.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview At the intersection of entertainment and technology, Tautulli, a Python-based tool for monitoring and tracking Plex Media Server, has been identified to harbor a serious vulnerability (CVE-2025-58760). This vulnerability affects Tautulli version 2.15.3 and earlier and poses a significant risk to system security and data integrity. The issue rests on the `\/image` API endpoint, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[85,76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-75992","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-directory-traversal","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t