CVE-2026-49995mediumCWE-79

CVE-2026-49995: medium-severity vulnerability in Tautulli

Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Published · Updated

Follow this CVE+ Monitor Tautulli

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.6%
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Tautulli · Tautulli
Related CVEs — Tautulli

In the same product, most dangerous first.

CVE-2026-31831HIGHTautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpointEPSS 2.0%CVE-2025-58763HIGHTautulli vulnerable to Authenticated Remote Code Execution via Command InjectionEPSS 1.7%CVE-2025-58762CRITICALTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentEPSS 0.8%CVE-2025-58761HIGHTautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`EPSS 0.7%CVE-2025-58760HIGHTautulli vulnerable to Unauthenticated Path Traversal in `/image` endpointEPSS 0.6%CVE-2026-52835HIGHTautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_databaseEPSS 0.6%