CVE-2025-58760

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the `/image` API endpoint is used to serve static images from the application's data directory to users. This endpoint can be accessed without authentication, and its intended purpose is for server background images and icons within the user interface. Attackers can exfiltrate files from the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application. Version 2.16.0 contains a fix for the issue.

• CWE-23

• https://github.com/Tautulli/Tautulli/commit/47566128e2e5dde98980d59b7a51b98173bc0b40Patch
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-8g4r-8f3f-hghpExploit, Vendor Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58755MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58756MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58757MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58758TinyEnv is an environment variable loader for PHP applicatio…7.3
• CVE-2025-58759TinyEnv is an environment variable loader for PHP applicatio…6.5
• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58763Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8
• CVE-2025-58765wabac.js provides a full web archive replay system, or 'wayb…7.1
• CVE-2025-58766Dyad is a local AI app builder. A critical security vulnerab…9