LoginSign Up
← Back to all sparks
T

Tautulli

ANALYTICS
Velocity0.0

Monitoring and analytics for Plex media servers

tautulli.com ↗

Plex's analytics companion has spent a year shipping CVE fixes faster than features.

plexself-hostedcve-remediationnotificationsnewslettersanalytics
◆Current state
Tautulli monitors and reports on Plex Media Server activity, and its last five releases read almost entirely as a security remediation programme: reflected XSS, stored XSS in newsletter cron values, two separate remote code execution paths, path traversal in uploaded filenames and in the newsletter image endpoint, and an open redirect. Each carries a CVE and an external reporter credit. Feature work — notification parameters, exporter fields, media flag images — rides along in the margins.
◆Where it's heading
The project is being audited by outside researchers at a rate its two-to-three-month release cadence was not designed for, and the response has been to raise the floor rather than redesign: minimum Python moved from 3.8 to 3.9 to 3.10 in a year, endpoints now validate paths and formats, and basic auth was pulled off the newsletter and image routes. The template-evaluation and custom-template-directory features that produced two RCEs are the recurring weak point, and they remain in the product.
◆Prediction
Expect the next release to continue hardening the newsletter and notification templating paths, since that subsystem has produced the most severe findings. The date fields on these releases are inconsistent with their own changelog headers, so the published cadence should be read loosely.

◆Recent moves

  1. 1mo ago

    Four CVEs closed: XSS, path traversal and open redirect

    The densest security release in the window — XSS in the newsletter cron value and in the search query string, path traversal in uploaded database and config filenames, and an open redirect via whitespace bypass in /auth/redirect, each externally reported. The non-security content is a Gotify line-break fix and duplicated progress timers.

    View source ↗
  2. 3mo ago

    RCE via newsletter custom template directory fixed; AV1 and Opus flags added

    Another remote code execution path closed in the newsletter templating subsystem, which is the second RCE from that area in three releases. Alongside it, the feature work is modest: AV1 and Opus media flag images, extra notification parameters, and a fix for Tautulli failing to reconnect to Plex after a dropped connection.

    View source ↗
  3. 4mo ago

    Python 3.10 now required; RCE in notification text evaluation fixed

    The release that raises the minimum Python to 3.10 and closes an RCE in notification text evaluation plus an unauthenticated path traversal in the newsletter image endpoint. The notes lead with an explicit warning that all versions at or below 2.16.1 are vulnerable.

    View source ↗
  4. 4mo ago

    Image endpoints validate paths and formats after four CVEs

    Four CVEs from a single reporter covering image path and format validation across /image and /pms_image_proxy, plus removing shell invocation from a git command. This is the release that started the current pattern of security-first notes.

    View source ↗
  5. 5mo ago

    Plex token expiry alerts and a code editor for newsletter templates

    The one release in this window driven by features rather than findings: a notification trigger for expired Plex tokens, an Ace editor with syntax highlighting for newsletter message text, new time formats for home stats and activity cards, and zipped backups. Graphs were also restricted for guest users.

    View source ↗
  6. 1y ago

    Config values can now be set via environment variables

    Environment-variable configuration is the durable change here — it makes Tautulli materially easier to run as a container without a mounted config file. The rest is exporter attributes for accessibility subtitle and audio tracks, and a fix for collections over 1000 items.

    View source ↗