HIGH🇵🇱 Wersja polska

CVE-2026-31831

CVSS 8.7v4.0pub. 2026-03-30upd. 2026-04-02

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Tautulli

    APP
    Tautulli
    < 2.17.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalAuth Bypass
CWE
References

Related vulnerabilities

CVE-2025-58762CRITICAL9.1PL ✓same product

Tautulli: RCE przez path traversal w endpoincie pms_image_proxy

CVE-2026-32275HIGH7.4same product

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before v...

CVE-2026-28505HIGH7.5same product

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the st...

CVE-2025-58763HIGH8.0same product

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerabili...

CVE-2025-58760HIGH8.6same product

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Ta...