Tautulli vulnérable à une traversée de chemin non authentifiée dans le point de terminaison `/image`

The /image API endpoint in Tautulli, responsible for serving static images, is vulnerable to path traversal. Because this endpoint is accessible without authentication, any attacker can exploit it. By crafting malicious requests, an attacker can bypass intended access controls and read files outside the intended directory. This could include configuration files, database backups, or even parts of the application's source code, depending on the server's file system layout and permissions. The potential impact ranges from information disclosure to, in extreme cases, complete server compromise if sensitive credentials or keys are exposed.

Organizations running Plex Media Server with Tautulli installed are at risk, particularly those with publicly accessible Tautulli instances or those using default configurations. Shared hosting environments where multiple users share the same server are also at increased risk, as a compromised Tautulli instance could potentially expose data belonging to other users.

• python / server:

# Check for Tautulli processes and versions
ps aux | grep tautulli

# Monitor access logs for suspicious requests to /image endpoint
grep '/image/' /var/log/nginx/access.log

• generic web:

# Attempt to access a file outside the intended image directory
curl http://<tautulli_ip>/image/../../../../etc/passwd

1. 2025-09-09Disclosure

   disclosure

1. Réservé2025-09-04
2. Publiée2025-09-09
3. Modifiée2025-09-10
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-58760 is to upgrade Tautulli to version 2.16.0 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal attempts targeting the /image endpoint. Specifically, look for requests with characters like ../ or absolute paths. Additionally, review file system permissions to ensure that the Tautulli application directory is not writable by the web server user. After upgrading, confirm the fix by attempting to access a file outside the intended image directory via the /image endpoint; the request should be denied.