CVE-2026-41065

Published: Giu 04, 2026 Last Modified: Giu 04, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,9

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

Description

AI Translation Available

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.

1336

Improper Neutralization of Special Elements Used in a Template Engine

Incomplete

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity

Potential Impacts:

Execute Unauthorized Code Or Commands

Applicable Platforms

Languages: Java, PHP, Python, JavaScript, Interpreted

Technologies: Not Technology-Specific, AI/ML, Client Server

View CWE Details

https://github.com/Tautulli/Tautulli/security/advisories/GH…

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp

https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1