PT-2026-28790 · Tautulli+1 · Tautulli+1

Jakeperalta7 · Published 2026-03-28 · Updated 2026-03-31 · CVE-2026-31831

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is susceptible to a path traversal issue. This allows unauthenticated attackers to read arbitrary files from the application server’s filesystem. The vulnerable parameter is not explicitly mentioned.

Recommendations Update to Tautulli version 2.17.0 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-31831

GHSA-XP55-2PF4-FV8M

Affected Products

Plex Media Server

Tautulli

References · 8

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31831.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31831 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31831 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Note
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Reddit Post
• https://twitter.com/infoflowcloud/status/2038918277397671944 · Twitter Post
• https://twitter.com/CVEnew/status/2038916094950613047 · Twitter Post