CVE-2025-58760: Tautulli Path Traversal Vulnerability

CVE-2025-58760 Overview

CVE-2025-58760 is a path traversal vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The /image API endpoint in Tautulli v2.15.3 and earlier allows unauthenticated attackers to read arbitrary files from the application server's filesystem. This endpoint, intended to serve static images for server backgrounds and icons within the user interface, can be accessed without authentication, making it a prime target for exploitation.

Attackers exploiting this vulnerability can exfiltrate sensitive files from the application filesystem, including the tautulli.db SQLite database containing active JWT tokens, as well as the config.ini file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application.

Critical Impact

Unauthenticated attackers can read sensitive configuration files and database contents, potentially leading to full administrative takeover of Tautulli and exposure of Plex Media Server credentials.

Affected Products

• Tautulli versions prior to v2.16.0
• Tautulli v2.15.3 and earlier releases
• All Tautulli installations with the /image API endpoint exposed

Discovery Timeline

• 2025-09-09 - CVE-2025-58760 published to NVD
• 2025-09-18 - Last updated in NVD database

Technical Details for CVE-2025-58760

Vulnerability Analysis

This path traversal vulnerability (CWE-23: Relative Path Traversal) exists in the /image API endpoint of Tautulli. The endpoint is designed to serve static images from the application's data directory but fails to properly sanitize user-supplied input, allowing attackers to traverse the directory structure and access files outside the intended directory.

The vulnerability is particularly dangerous because the /image endpoint does not require authentication. This means any network-accessible Tautulli instance is potentially vulnerable to exploitation without the attacker needing valid credentials. The attack can be executed remotely with no user interaction required.

Root Cause

The root cause of CVE-2025-58760 is insufficient input validation in the /image API endpoint. The endpoint accepts path parameters without properly sanitizing path traversal sequences such as ../ (dot-dot-slash). This allows attackers to escape the intended image directory and navigate to arbitrary locations on the filesystem where the Tautulli process has read permissions.

Attack Vector

The attack vector for this vulnerability involves crafting malicious HTTP requests to the /image endpoint with path traversal sequences. By manipulating the path parameter, an attacker can navigate outside the designated image directory and access sensitive files.

Key targets for exfiltration include:

• tautulli.db: The SQLite database containing active JWT session tokens that can be reused for authentication bypass
• config.ini: Configuration file containing the hashed admin password, JWT token secret, and Plex Media Server credentials

The attack requires no authentication and can be performed by any user with network access to the Tautulli web interface. An attacker can exploit this vulnerability by sending crafted HTTP GET requests with directory traversal sequences (e.g., ../../../) in the image path parameter to reach files outside the intended directory. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2025-58760

Indicators of Compromise

• HTTP requests to the /image endpoint containing path traversal sequences such as ../ or ..%2F
• Unusual access patterns to the /image API endpoint from external IP addresses
• Evidence of tautulli.db or config.ini file access in application logs
• Unexpected authentication events using JWT tokens extracted from the database

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in URL parameters
• Monitor HTTP access logs for requests to /image containing encoded or unencoded directory traversal sequences
• Enable verbose logging in Tautulli and correlate access logs with file system auditing
• Use intrusion detection systems (IDS) with signatures for path traversal attacks

Monitoring Recommendations

• Configure alerts for any access to sensitive files such as tautulli.db and config.ini from the web application context
• Monitor for unusual JWT token usage patterns or authentication from unexpected IP addresses
• Implement network traffic analysis to detect large file transfers from the Tautulli server
• Review Tautulli access logs regularly for anomalous request patterns targeting the /image endpoint

How to Mitigate CVE-2025-58760

Immediate Actions Required

• Upgrade Tautulli to version 2.16.0 or later immediately to address this vulnerability
• Restrict network access to the Tautulli web interface using firewall rules to limit exposure
• Rotate the admin password and regenerate JWT token secrets after patching
• Review access logs for any evidence of prior exploitation before applying the patch

Patch Information

Tautulli version 2.16.0 contains the fix for this path traversal vulnerability. The security patch is available in commit 47566128e2e5dde98980d59b7a51b98173bc0b40. Users should update to the latest version as soon as possible.

For detailed patch information, refer to the GitHub Commit Details and the GitHub Security Advisory.

Workarounds

• Place Tautulli behind a reverse proxy with authentication requirements for all endpoints including /image
• Implement network segmentation to limit access to the Tautulli server to trusted internal networks only
• Use a web application firewall (WAF) to filter requests containing path traversal patterns
• Temporarily disable external access to the Tautulli interface until patching is complete

# Example: Restrict access to Tautulli using iptables
# Allow only localhost and trusted internal network
iptables -A INPUT -p tcp --dport 8181 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8181 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8181 -j DROP