Is CVE-2026-52835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52835 being exploited in the wild.

How severe is CVE-2026-52835?

Informational severity, published 21 September 2026.

Is there a fix for CVE-2026-52835?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52835 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52835?

Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52835: Tautulli path traversal in file upload handlers

CVE-2026-52835 · Severity: info · Published 2026-09-21

Tautulli is a monitoring and tracking tool for Plex Media Server that allows administrators to manage configurations and databases. Prior to version 2.17.2, an authenticated administrator with the API key could upload files with specially crafted names containing path traversal sequences (../) to write files outside the intended cache directory, potentially allowing them to tamper with configuration, disrupt the service, or achieve code execution.

Technologies: Tautulli. Vendors: Tautulli.

Quick answers

Is CVE-2026-52835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52835 being exploited in the wild.
How severe is CVE-2026-52835?: Informational severity, published 21 September 2026.
Which products and versions are affected?: Tautulli before 2.17.2.
Is there a fix for CVE-2026-52835?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52835 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52835?: Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the import_config and import_database handlers in plexpy/webserve.py, which join attacker-controlled multipart upload filenames directly to CACHE_DIR without canonicalization (basename reduction) or containment checks. An authenticated caller can submit filenames with ../ segments to write outside the intended directory. The write scope is limited to paths the Tautulli process has permission to access, but the lack of filename sanitization before joining enables arbitrary file creation or overwrite within process permissions. Fixed in 2.17.2 by applying os.path.basename to reduce filenames before joining.

Affected products

Tautulli Tautulli before 2.17.2

Timeline

2026-06-16: disclosed: Fixed in version 2.17.2
2026-09-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.