CVE-2026-31831

CVSS 8.7v4.0pub. 2026-03-30upd. 2026-04-02

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

oryginał EN

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Tautulli
APP
Tautulli
< 2.17.0

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

Tagi

Path TraversalAuth Bypass

CWE

CWE-23

Referencje

github.com/Tautulli/Tautulli/releases/tag/v2.17.0…

github.com/Tautulli/Tautulli/security/advisories/GHSA-x…

Powiązane podatności

CVE-2025-58762CRITICAL9.1PL ✓ten sam produkt

Tautulli: RCE przez path traversal w endpoincie pms_image_proxy

CVE-2026-32275HIGH7.4ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before v...

CVE-2026-28505HIGH7.5ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the st...

CVE-2025-58763HIGH8.0ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerabili...

CVE-2025-58760HIGH8.6ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Ta...