CVE-2026-43984: Tautulli has stored XSS in logFile via guest-controlled log_js_errors input
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose logjserrors to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only logFile view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tautullito a version that resolves this vulnerability.Fixed in 2.17.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43984?
CVE-2026-43984 has a high severity score of 8.9.
How do I fix CVE-2026-43984?
To fix CVE-2026-43984, upgrade Tautulli to version 2.17.1 or later.
What type of vulnerability is CVE-2026-43984?
CVE-2026-43984 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-43984?
CVE-2026-43984 impacts all versions of Tautulli prior to 2.17.1, particularly those with guest access enabled.
What can an attacker achieve with CVE-2026-43984?
An attacker can write malicious scripts into the application log through the guest-controlled log_js_errors input.