CVE-2026-52835
Deferred Deferred - Pending Action

Path Traversal in Tautulli Media Server

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR before file-content validation runs. The write is limited to paths permitted to the Tautulli process, but it can enable configuration tampering, service disruption, or code execution. This issue is fixed in version 2.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-52835
EUVD
EUVD-2026-84067

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tautulli tautulli 2.17.2
tautulli tautulli to 2.17.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52835 is a path traversal and arbitrary file write vulnerability in Tautulli versions before 2.17.2. It occurs when the import_config and import_database handlers directly join attacker-controlled filenames to the cache directory without sanitization. Attackers with an API key can upload files with parent-directory segments like ../ to escape the cache directory and write files elsewhere on the filesystem.

Detection Guidance

Check Tautulli version with: pip show tautulli or grep version in Tautulli source. Monitor for unexpected file writes outside cache directory. Review logs for multipart uploads with ../ in filenames.

Impact Analysis

This vulnerability allows attackers to overwrite sensitive files, tamper with configurations, disrupt services, or execute arbitrary code. The impact depends on the permissions of the Tautulli process. Since the write is limited to paths the process can access, it may enable full system compromise if Tautulli runs with elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside intended directories, potentially allowing attackers to overwrite configuration files or execute malicious code. Such unauthorized access may violate data integrity and confidentiality requirements under GDPR and HIPAA, depending on the affected system's role in processing personal or health data.

Mitigation Strategies

Upgrade Tautulli to version 2.17.2 or later. Restrict API key access to trusted users. Monitor filesystem for unauthorized writes. Review configurations for tampering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart