CVE-2026-40605CWE-22CWE-73

Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API

Medium · published June 4, 2026

CVSS v4.0
5.7
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00454 · 38.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-06-04T12:50Z
EPSS history
Timeline
  • 04 JUN 12:50Z
    Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API
    cvelistv5