LoginSign Up
← Back to all sparks
T

Tautulli

ANALYTICS
Velocity5.0

Monitoring and analytics for Plex media servers

tautulli.com ↗

Tautulli's release notes read like a security advisory with a changelog attached.

media-analyticsplexsecurity-fixescvenotificationspush-relay
◆Current state
Every release in the past year has closed CVEs — path traversal, XSS, open redirect, SQL injection, remote code execution in notification text and in newsletter templates. v2.18.1 keeps the run going with an API fix for guest users being able to retrieve another user's history, and adds an X-Frame-Options header to the config file. The feature work sits in v2.18.0 two days earlier: Dolby Atmos on activity cards and in notification parameters, history pagination moved from Python into SQL, and a push relay for Remote App notifications.
◆Where it's heading
Two threads run in parallel. Researchers have not stopped finding issues, and the fixes have shifted from patching individual endpoints toward changing defaults — validated paths, an authenticated image proxy, and now a framing header written into the config. The other thread is the notification stack moving off OneSignal, which the project has dated for deprecation on 1 October 2026, onto a relay it controls.
◆Prediction
Expect another 2.18.x patch closing whatever the current round of reports surfaces, and the OneSignal migration to be pushed harder in release notes as the October deadline approaches.

◆Recent moves

  1. 19d ago

    Guest history exposure closed in the API; X-Frame-Options added

    A patch release that is mostly fixes — empty session rows written to the database, email passwords blanked on save, new-device notifications retriggering — with one that carries further: guest users could retrieve another user's history through the API. The X-Frame-Options config entry is the only addition, and it is hardening rather than a feature.

    View source ↗
  2. 22d ago

    Dolby Atmos support and a push relay replacing OneSignal

    Adds Atmos to activity cards and notification parameters, moves history pagination into SQL for performance, and introduces a push relay for Remote App notifications ahead of OneSignal's deprecation in October. Two more CVEs are closed alongside it, keeping the release in the pattern every version here has followed.

    View source ↗
  3. 3mo ago

    Four CVEs closed: XSS, path traversal and open redirect

    An almost entirely security-driven release covering XSS in newsletter cron values and search query strings, path traversal in uploaded file names, and an open redirect via whitespace bypass. The only functional fixes are cosmetic by comparison.

    View source ↗
  4. 4mo ago

    RCE via newsletter custom template directory fixed; AV1 and Opus flags added

    Closes a remote code execution path through custom newsletter template directories plus three further CVEs, and moves Windows and macOS packages to Python 3.13. The AV1 and Opus media flags are the visible additions.

    View source ↗
  5. 5mo ago

    Python 3.10 now required; RCE in notification text evaluation fixed

    Drops Python 3.9, fixes remote code execution in notification text evaluation, SQL injection in get_home_stats and an unauthenticated path traversal, and removes the get_apikey API command. The release note leads with an explicit instruction to upgrade off 2.16.1 and earlier.

    View source ↗
  6. 5mo ago

    Image endpoints validate paths and formats after four CVEs

    Adds path and format validation to the image and pms_image_proxy endpoints and stops running git through a shell, closing four reported vulnerabilities. The start of the sustained researcher attention visible in every release since.

    View source ↗