# CVE-2026-52835: Tautulli path traversal in file upload handlers

Source: https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-52835 · Severity: info · Published 2026-09-21

Tautulli is a monitoring and tracking tool for Plex Media Server that allows administrators to manage configurations and databases. Prior to version 2.17.2, an authenticated administrator with the API key could upload files with specially crafted names containing path traversal sequences (../) to write files outside the intended cache directory, potentially allowing them to tamper with configuration, disrupt the service, or achieve code execution.

Technologies: [Tautulli](https://junglewise.ai/threats/technologies/tautulli). Vendors: [Tautulli](https://junglewise.ai/threats/vendors/tautulli).

## Quick answers

**Is CVE-2026-52835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52835 being exploited in the wild.

**How severe is CVE-2026-52835?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** Tautulli before 2.17.2.

**Is there a fix for CVE-2026-52835?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52835 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52835?** Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the import_config and import_database handlers in plexpy/webserve.py, which join attacker-controlled multipart upload filenames directly to CACHE_DIR without canonicalization (basename reduction) or containment checks. An authenticated caller can submit filenames with ../ segments to write outside the intended directory. The write scope is limited to paths the Tautulli process has permission to access, but the lack of filename sanitization before joining enables arbitrary file creation or overwrite within process permissions. Fixed in 2.17.2 by applying os.path.basename to reduce filenames before joining.

## Affected products

- Tautulli Tautulli before 2.17.2

## Timeline

- 2026-06-16: disclosed: Fixed in version 2.17.2
- 2026-09-21: advisory

## References

- [https://github.com/Tautulli/Tautulli/commit/8c7c1a5ab09a6cca00aec995df07ce24680e7f31](https://github.com/Tautulli/Tautulli/commit/8c7c1a5ab09a6cca00aec995df07ce24680e7f31)
- [https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2](https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2)

## Related threats

- [Tautulli open redirect via whitespace bypass in /auth/redirect](https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli stored XSS in newsletter cron field](https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli reflected XSS in search query](https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli unauthenticated SSRF in image route](https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route)
- [Tautulli CSRF in configUpdate allows administrator takeover](https://junglewise.ai/threats/cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover)