---
id: CVE-2026-52835
title: Tautulli is a Python based monitoring and tracking tool for Plex Media Server
summary: >-
  Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
  Prior to 2.17.2, the import_config handler and the database_file branch of
  import_database in plexpy/webserve.py join the attacker-controlled
  config_file.file…
severity: high
cvss: 7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
  - CWE-434
vendor: Tautulli
product: Tautulli
affected:
  - Tautulli < 2.17.2
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T20:17:26.280'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52835'
references:
  - url: >-
      https://github.com/Tautulli/Tautulli/commit/8c7c1a5ab09a6cca00aec995df07ce24680e7f31
    label: security-advisories@github.com
  - url: 'https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Tautulli/Tautulli/security/advisories/GHSA-8ww5-pp25-3jm8
    label: security-advisories@github.com
  - url: >-
      https://github.com/Tautulli/Tautulli/security/advisories/GHSA-8ww5-pp25-3jm8
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T19:50:07.232486Z'
cvssSource: cna
ingestedAt: '2026-09-21T19:51:58.879Z'
epss: 0.00496
epssPercentile: 0.41647
---

## Overview

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR before file-content validation runs. The write is limited to paths permitted to the Tautulli process, but it can enable configuration tampering, service disruption, or code execution. This issue is fixed in version 2.17.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.