v2.17.0Desktop
Tautulli v2.17.0
Added 3
- Added ability to export square art images
- Added ability to export theme music
- Added rating to get_home_stats API command
Changed 3
- Updated Bootstrap CSS to v3.4.1 and decouple overrides
- Updated Bootstrap-select to v1.13.18
- Updated third party donation logos
Fixed 4
- Media from other video libraries using modern Plex agents not showing up on newsletter
- Logo images incorrectly exported as jpg instead of png
- History modal not opening when clicking on graphs
- Validate log path for Plex log files
Removed 2
- Support for Python 3.9 has been dropped; minimum Python version is now 3.10
- Removed get_apikey API command
Security 5
- Prevent RCE in notification text evaluation (CVE-2026-28505)
- Fix unauthenticated path traversal in /newsletter/image/images endpoint (CVE-2026-31831)
- Fix SQL injection in get_home_stats API command (CVE-2026-31799)
- Fix unsanitized JSONP callback parameter (CVE-2026-32275)
- Add authentication to /pms_image_proxy endpoint (CVE-2026-31804)
Changelog
v2.17.0 (2026-03-27)
- Important Note!
- Several security vulnerabilities have been identified in Tautulli versions <=2.16.1. Users are strongly encouraged to update to the latest Tautulli version 2.17.x.
- Notes:
- Support for Python 3.9 has been dropped. The minimum Python version is now 3.10.
- Notifications:
- Fix: Prevent RCE in notification text evaluation. (CVE-2026-28505) (Thanks @q1uf3ng)
- Newsletters:
- Fix: Media from other video libraries using the modern Plex agents not showing up on newsletter.
- Fix: Unauthenticated path traversal in /newsletter/image/images endpoint. (CVE-2026-31831) (Thanks @JakePeralta7)
- Exporter:
- Fix: Logo images incorrectly exported as jpg instead of png.
- New: Added ability to export square art images.
- New: Added ability to export theme music. (#2654)
- Graphs:
- Fix: History modal not opening when clicking on graphs. (#2652)
- API:
- Fix: SQL injection in get_home_stats API command. (CVE-2026-31799) (Thanks @mandreko)
- Fix: Unsanitized JSONP callback parameter. (CVE-2026-32275) (Thanks @mandreko)
- New: Added rating to get_home_stats API command. (#2655) (Thanks @jma1ice)
- Removed: get_apikey API command.
- Other:
- Fix: Validate log path for Plex log files. (#2632)
- Fix: Add authentication to /pms_image_proxy endpoint. (CVE-2026-31804) (Thanks @mandreko)
- New: Updated third party donation logos. (#2646) (Thanks @aisgbnok)
- New: Update Bootstrap CSS to v3.4.1 and decouple overrides (#2662) (Thanks @aisgbnok)
- New: Update Bootstrap-select to v1.13.18 (#2666) (Thanks @aisgbnok)
🛡 VirusTotal GitHub Action analysis: