Tautulli, a monitoring tool for Plex Media Server, has a vulnerability that allows any authenticated user with guest access to write attacker-controlled strings into the main application log. The administrator‑only logFile view then renders this log file into an HTML response without escaping, creating a stored cross‑site scripting condition. An attacker can inject malicious HTML or JavaScript into the log, which will execute in the administrator’s browser when the log viewer is accessed, potentially compromising administrator credentials or executing arbitrary commands.

Versions of Tautulli prior to 2.17.1 are affected. The issue is present in all releases of the Tautulli product that support guest access and expose the log_js_errors endpoint.

The vulnerability has a CVSS score of 8.9 and is not listed in the CISA KEV catalog. No EPSS score is available, which indicates that publicly available exploitation data is lacking. The attack vector is inferred to require authenticated guest access, meaning it is not an open‑world flaw but still exploitable within an environment where guest users are enabled. Given the high severity score and the ability of a low‑privilege user to impact administrators, the risk is significant in settings where guest access is enabled.