LoginSign Up
← Back to all sparks
T

Tautulli

ANALYTICS
Velocity0.0

Monitoring and analytics for Plex media servers

tautulli.com ↗

Tautulli 2.18.2 fixes history grouping and closes another newsletter path traversal.

plexmedia analyticssecurity fixesnotificationsself-hosted
◆Current state
Tautulli, the Plex monitoring tool, shipped v2.18.2 in late September: history grouping now requires a matching guid, paused notifications stop repeating during buffering, and another path traversal in newsletter filenames is closed. It also adds Windows installer flags and loudness data in exports. The 2.18.0 feature release before it added Dolby Atmos and a push relay to replace OneSignal.
◆Where it's heading
Releases keep pairing a steady flow of security reports with small community-contributed features. History correctness is the other recurring thread, with regrouping logic changed so existing history splits by guid.
◆Prediction
Expect another 2.18.x patch of the same shape, with at least one security fix, since every release in the past year has carried one.

◆Recent moves

  1. 1mo ago

    Tautulli 2.18.2 fixes history grouping and a path traversal

    v2.18.2 tightens history grouping to matching guids, fixes repeating pause notifications during buffering and closes a newsletter-filename path traversal. Another release where a security fix rides alongside usability work.

    View source ↗
  2. 2mo ago

    Guest history exposure closed in the API; X-Frame-Options added

    A patch release that is mostly fixes — empty session rows written to the database, email passwords blanked on save, new-device notifications retriggering — with one that carries further: guest users could retrieve another user's history through the API. The X-Frame-Options config entry is the only addition, and it is hardening rather than a feature.

    View source ↗
  3. 2mo ago

    Dolby Atmos support and a push relay replacing OneSignal

    Adds Atmos to activity cards and notification parameters, moves history pagination into SQL for performance, and introduces a push relay for Remote App notifications ahead of OneSignal's deprecation in October. Two more CVEs are closed alongside it, keeping the release in the pattern every version here has followed.

    View source ↗
  4. 4mo ago

    Four CVEs closed: XSS, path traversal and open redirect

    An almost entirely security-driven release covering XSS in newsletter cron values and search query strings, path traversal in uploaded file names, and an open redirect via whitespace bypass. The only functional fixes are cosmetic by comparison.

    View source ↗
  5. 6mo ago

    RCE via custom newsletter templates fixed; AV1 and Opus flags added

    Closes a remote code execution path through custom newsletter template directories plus three further CVEs, and moves Windows and macOS packages to Python 3.13. The AV1 and Opus media flags are the visible additions.

    View source ↗
  6. 7mo ago

    Python 3.10 now required; RCE in notification text evaluation fixed

    Drops Python 3.9, fixes remote code execution in notification text evaluation, SQL injection in get_home_stats and an unauthenticated path traversal, and removes the get_apikey API command. The release note leads with an explicit instruction to upgrade off 2.16.1 and earlier.

    View source ↗