A path traversal flaw in Tautulli’s cache deletion API allows an authenticated user to specify a file path that resolves outside the designated cache directory, enabling deletion of arbitrary files. The vulnerability can lead to loss of user data, media files, and can disrupt the service’s operation. The flaw maps to the weaknesses of uncontrolled path traversal (CWE‑22) and relative path usage (CWE‑73).

Any installation of Tautulli that runs a version prior to 2.17.1 is susceptible. The issue affects all users who have enabled API access and trust authentication credentials, because the cache deletion endpoint can be invoked by anyone who can authenticate to the Tautulli instance.

The CVSS score of 5.7 indicates moderate severity. Exploitation requires valid API credentials, meaning the attacker must first authenticate locally or remotely to the Tautulli service. Because the flaw can delete arbitrary data, the potential impact is high for confidentiality and availability if the attacker targets critical media or configuration files. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Nonetheless, the presence of a path traversal flaw that bypasses directory restrictions warrants prompt attention.