CVE-2026-31799
MEDIUM
4,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters 'before' and 'after' and from version 2.1.0-beta to before version 2.17.0 for parameters 'section_id' and 'user_id', the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
20
Improper Input Validation
StableCommon Consequences
Security Scopes Affected:
Availability
Confidentiality
Integrity
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Read Memory
Read Files Or Directories
Modify Memory
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-g47q-8j8w-m63q