PT-2026-28103 · Plex+1 · Plex Media Server+1

Q1Uf3Ng · Publicado 2026-03-25 · Atualizado 2026-03-31 · CVE-2026-28505

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. Before version 2.17.0, the str eval() function within the notification handler.py file implemented a sandboxed eval() function for notification text templates. The sandbox aimed to restrict callable names by inspecting code.co names of the compiled code object. However, code.co names only contains names from the outer code object. When a lambda expression was used, it created a nested code object, and attribute accesses were stored in code.co consts, not code.co names. Consequently, the sandbox did not inspect nested code objects.

Recommendations Update Tautulli to version 2.17.0 or later.

Exploit

Correção

Code Injection

Eval Injection

Enumeração de Fraquezas

CWE-94

CWE-95

Identificadores relacionados

CVE-2026-28505

GHSA-M62J-GWM9-7P8M

Produtos afetados

Plex Media Server

Tautulli

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28505.json · Exploit
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m62j-gwm9-7p8m · Aviso do Fabricante
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28505 · Nota de Segurança
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Publicação no Twitter
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Publicação no Reddit
• https://twitter.com/infoflowcloud/status/2038918314903183623 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038916096812896522 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28505 · Aviso do Fabricante