HIGH🇵🇱 Wersja polska

CVE-2026-31831

CVSS 8.7v4.0pub. 2026-03-30upd. 2026-04-02

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Tautulli

    APP
    Tautulli
    < 2.17.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalAuth Bypass
CWE
References

Related vulnerabilities

CVE-2025-58762CRITICAL9.1PL ✓ten sam produkt

Tautulli: RCE przez path traversal w endpoincie pms_image_proxy

CVE-2026-32275HIGH7.4ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before v...

CVE-2026-28505HIGH7.5ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the st...

CVE-2025-58763HIGH8.0ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerabili...

CVE-2025-58760HIGH8.6ten sam produkt

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Ta...