CVE-2025-58761

CVE-2025-58761 is a path traversal vulnerability in Tautulli v2.15.3 and earlier, a monitoring tool for Plex Media Server. An unauthenticated attacker can exploit the real_pms_image_proxy endpoint to read arbitrary files from the application server's filesystem, bypassing validation by combining a valid prefix with path traversal characters. This high-severity vulnerability (CVSS 7.5) allows for exfiltration of sensitive data like the tautulli.db and config.ini files, potentially leading to administrative control over the application. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.