Tautulli <= 2.16.1 - Path Traversal
CVE-2026-31831
Verified
Description
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
tautulli
Published Date
June 5, 2026
Template Author
wrg-11
CVE-2026-31831.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-31831
CWE ID:
cwe-22
Remediation Steps
Update to version 2.17.0 or later.