PT-2026-46228 · Tautulli · Tautulli

Published 2026-06-04 · Updated 2026-06-04 · CVE-2026-40605

Mitre

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-40605

Affected Products

Tautulli

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40605 · Security Note
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-fg46-xx7h-mhwr · Note
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 · Note