CVE-2025-58760: Path Traversal in Tautulli

The /image API endpoint in Tautulli, responsible for serving static images, is vulnerable to path traversal. Because this endpoint is accessible without authentication, any attacker can exploit it. By crafting malicious requests, an attacker can bypass intended access controls and read files outside the intended directory. This could include configuration files, database backups, or even parts of the application's source code, depending on the server's file system layout and permissions. The potential impact ranges from information disclosure to, in extreme cases, complete server compromise if sensitive credentials or keys are exposed.

1. Reserved2025-09-04
2. Published2025-09-09
3. Modified2025-09-10
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58760 is to upgrade Tautulli to version 2.16.0 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal attempts targeting the /image endpoint. Specifically, look for requests with characters like ../ or absolute paths. Additionally, review file system permissions to ensure that the Tautulli application directory is not writable by the web server user. After upgrading, confirm the fix by attempting to access a file outside the intended image directory via the /image endpoint; the request should be denied.