PT-2026-28790 · Tautulli+1 · Tautulli+1

Jakeperalta7 · Publicado 2026-03-28 · Atualizado 2026-03-31 · CVE-2026-31831

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is susceptible to a path traversal issue. This allows unauthenticated attackers to read arbitrary files from the application server’s filesystem. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to Tautulli version 2.17.0 or later.

Exploit

Correção

Relative Path Traversal

Enumeração de Fraquezas

CWE-23

Identificadores relacionados

CVE-2026-31831

GHSA-XP55-2PF4-FV8M

Produtos afetados

Plex Media Server

Tautulli

Referências · 8

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31831.json · Exploit
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Nota
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31831 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2038918277397671944 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31831 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916094950613047 · Publicação no Twitter