Tautulli versions prior to 2.17.2 contain an unsanitized file upload handling in import_config and import_database that concatenates attacker‑controlled filenames directly to CACHE_DIR. This allows an administrator or user with the instance API key to craft a multipart filename with parent‑directory segments, resulting in an arbitrary write outside the intended cache directory. The vulnerability corresponds to path traversal and insecure upload validation and can enable configuration tampering, service disruption, or remote code execution if vulnerable files are overwritten or injected.

The affected product is Tautulli, a Python‑based monitoring tool for Plex Media Server. Any instance running a version earlier than 2.17.2, including all sub‑versions before that release, is susceptible.

The CVSS score is 7, indicating medium‑to‑high severity. Exploit probability data from EPSS is not available, and the issue is not listed in the CISA KEV catalog. The exploit requires possession of the Tautulli instance API key, which typically an administrator has. Once authenticated, an attacker can upload a malicious filename to place files wherever the Tautulli process has write permission, thus enabling configuration tampering or potentially executing code if the overwrite affects critical runtime files.