CVE-2026-45381 | BDVDB-2026-377294 Detail

Description#

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-21Record published in the CVE List.
2. Version 22026-09-29Most recent update recorded in the CVE List.