Tautulli up to 2.17.1 File Upload plexpy/webserve.py import_config/import_database config_file.filename/database_file.filename path traversal

Summaryinfo

A vulnerability, which was classified as problematic, was found in Tautulli up to 2.17.1. The impacted element is the function import_config/import_database of the file plexpy/webserve.py of the component File Upload. The manipulation of the argument config_file.filename/database_file.filename results in path traversal. This vulnerability was named CVE-2026-52835. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Tautulli up to 2.17.1. It has been classified as problematic. Affected is the function import_config/import_database of the file plexpy/webserve.py of the component File Upload. The manipulation of the argument config_file.filename/database_file.filename with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR before file-content validation runs. The write is limited to paths permitted to the Tautulli process, but it can enable configuration tampering, service disruption, or code execution. This issue is fixed in version 2.17.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-52835 since 06/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.17.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Tautulli

Version

• 2.17.0
• 2.17.1

Website

• Product: https://github.com/Tautulli/Tautulli/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion