# Tautulli v2.16.0 — Tautulli v2.16.0

- Product: Tautulli (https://whatsnew.fyi/product/tautulli)
- Vendor: Tautulli
- Date: 2025-09-09
- Version: v2.16.0
- Original notes: https://github.com/Tautulli/Tautulli/releases/tag/v2.16.0
- Permalink: https://whatsnew.fyi/product/tautulli/releases/v2.16.0
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Validate image path in /image endpoints (CVE-2025-58760)
- **security** — Validate image path in /pms_image_proxy endpoints (CVE-2025-58761)
- **security** — Validate image format in /pms_image_proxy endpoint (CVE-2025-58762)
- **security** — Don't run git command with shell (CVE-2025-58763)
- **fixed** — Race condition in image cache directory creation
- **fixed** — Update poster click-through overlay to new Plex logo

##### Changelog

###### v2.16.0 (2025-09-08)

* Important Note!
  * Several security vulnerabilities have been identified in Tautulli versions <=2.15.3. Users are strongly encouraged to update to the latest Tautulli version 2.16.x.
* UI:
  * Fix: Update poster click-through overlay to new Plex logo. (#2584) (Thanks @TheMeanCanEHdian)
* Other:
  * Fix: Race condition in image cache directory creation. (#2580) (Thanks @keithah)
  * Fix: Validate image path in /image endpoints. (CVE-2025-58760) (Thanks @d-xuan)
  * Fix: Validate image path in /pms_image_proxy endpoints. (CVE-2025-58761) (Thanks @d-xuan)
  * Fix: Validate image format in /pms_image_proxy endpoint. (CVE-2025-58762) (Thanks @d-xuan)
  * Fix: Don't run git command with shell. (CVE-2025-58763) (Thanks @d-xuan)


🛡 [VirusTotal GitHub Action](https://github.com/crazy-max/ghaction-virustotal) analysis:
  * [`Tautulli-macos-v2.16.0-universal.pkg`](https://www.virustotal.com/gui/file-analysis/MjEwYmYxZWU3NzEwYjgyYzZiMDMyMWJiNzAzNTliNzM6MTc1NzM3OTk0OA==/detection)
  * [`Tautulli-windows-v2.16.0-x64.exe`](https://www.virustotal.com/gui/file-analysis/NWY3ZWY2NDVlM2FjZTYxOGFjM2QwZjhmYzQzYjNiNTM6MTc1NzM3OTk0Ng==/detection)