Critical · published September 10, 2025
🚨 An admin's oversight could unleash chaos! With Tautulli v2.15.3 and earlier, an attacker with admin access can write arbitrary Python scripts, leading to remote code execution. 🔥 Think of it like a hotel manager who leaves the back door wide open. If a crafty guest gains admin access, they could sneak in and rearrange the entire hotel—adding a few unsanctioned rooms, or worse! If exploited, an attacker could execute any code they want on the Tautulli server, potentially compromising sensitive data, disrupting services, or even taking complete control of the server. This is absolutely devastating for your media environment and user security!
Think of it like a hotel manager who leaves the back door wide open. If a crafty guest gains admin access, they could sneak in and rearrange the entire hotel—adding a few unsanctioned rooms, or worse! This vulnerability allows attackers with administrative access to exploit the `pms_image_proxy` endpoint, writing arbitrary files via unvalidated parameters. By combining this with the `Script` notification agent, they can execute malicious Python scripts on the server.
If exploited, an attacker could execute any code they want on the Tautulli server, potentially compromising sensitive data, disrupting services, or even taking complete control of the server. This is absolutely devastating for your media environment and user security! Upgrade to Tautulli version 2.16.0 immediately to patch this vulnerability. Additionally, review your administrative user access and consider implementing stricter controls on permissions to minimize risk. You've got this! With these steps, you can secure your Tautulli installation and protect your server! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tautulli/tautulli | < 2.16.0 | 2.16.0 |