CVE-2026-43984: Tautulli has stored XSS in logFile via guest-controlled log_js_errors input

Synopsis

Stored cross-site scripting (XSS) in Tautulli, a Python-based Plex Media Server monitoring tool, allows a low-privilege or guest user to inject malicious JavaScript into the application log via the `log_js_errors` endpoint. The injected payload is stored in the log file and executes in an administrator's browser when the log viewer is opened, requiring no further attacker interaction after the initial write. Successful exploitation gives the attacker full control over the administrator's browser session, enabling credential theft, account takeover, or further actions within Tautulli. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tautulli service over the network to call the `log_js_errors` endpoint; the CVSS vector specifies AV:N.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated user, including guest users when guest access is enabled, can invoke the vulnerable endpoint (PR:L).

• Victim interactionRequired

  An administrator must open the log viewer in their browser to trigger the stored payload, representing a required social-engineering or coincidental interaction step (UI:R).

• Attack complexityDetail

  The exploit is reliable and requires no special race conditions or environmental setup; CVSS specifies AC:L, meaning the attacker can write and wait for the payload to execute without additional preconditions.

Blast Radius

• An attacker reads the administrator's active Tautulli session token, enabling full account takeover without knowing credentials.
• Injected JavaScript can exfiltrate any data visible in the administrator's browser session, including API keys, configured integrations, and Plex user data displayed in the interface.
• The attacker can modify Tautulli settings or trigger administrative actions silently within the compromised browser session, altering monitoring configuration or notification targets.
• Service availability is partially affected (CVSS A:L); a crafted payload can degrade or disrupt the log viewer and dependent administrative workflows.