PT-2026-46257 · Tautulli · Tautulli

Larlarua · CVE-2026-43984 · Published 2026-06-04 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.1

Description A stored cross-site scripting condition exists where authenticated users, including guests, can inject HTML or JavaScript into the main application log. This occurs because the log js errors endpoint writes attacker-controlled strings directly into the log file. When an administrator accesses the logFile view, the application embeds the log content into an HTML response without proper escaping, leading to the execution of the injected code in the administrator's browser.

Recommendations Update to version 2.17.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43984

GHSA-F4J7-PJWC-4JRR

Affected Products

Tautulli

References · 5

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43984.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-43984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43984 · Security Note
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 · Note