# CVE-2026-43984: Tautulli stored XSS in logFile via log_js_errors

Source: https://junglewise.ai/threats/cve-2026-43984-tautulli-stored-xss-in-logfile-via-log-js-errors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-43984 · Severity: high · CVSS 8.9 · Published 2026-06-04

Tautulli, a monitoring tool for Plex Media Servers, contains a security flaw that allows guest users to inject malicious code into the system's activity logs. If an administrator later views these logs through the web interface, the injected code executes in their browser. This could allow a low-privileged user to hijack administrative sessions, steal sensitive data, or perform unauthorized actions on the server.

Technologies: [Tautulli](https://junglewise.ai/threats/technologies/tautulli). Vendors: [Tautulli](https://junglewise.ai/threats/vendors/tautulli).

## Quick answers

**Is CVE-2026-43984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43984 being exploited in the wild.

**How severe is CVE-2026-43984?** High severity, with a CVSS score of 8.9, published 4 June 2026.

**Which products and versions are affected?** Tautulli < 2.17.1.

**Is there a fix for CVE-2026-43984?** A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43984 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43984?** Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Tautulli's `log_js_errors` endpoint. This endpoint is accessible to any authenticated user, including guests, and writes user-provided strings directly into the application log file without sanitization. The administrative `logFile` view subsequently reads this log and renders it within a `<pre>` tag in an HTML response without proper escaping. An attacker can exploit this by submitting a crafted JavaScript payload to the error logging endpoint; the payload executes in the context of an administrator's session when they view the logs. This vulnerability is patched in version 2.17.1.

## Affected products

- Tautulli Tautulli < 2.17.1

## Timeline

- 2026-05-04: patched: Version 2.17.1 released
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: NVD publication date

## References

- [https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1](https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1)
- [https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr](https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr)

## Related threats

- [Tautulli open redirect via whitespace bypass in /auth/redirect](https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli path traversal in file upload handlers](https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli stored XSS in newsletter cron field](https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli reflected XSS in search query](https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli unauthenticated SSRF in image route](https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route)