CVE-2026-31831 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

What is CVE-2026-31831?

CVE-2026-31831 is a high-severity path traversal vulnerability in Tautulli, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

Weakness: CWE-23

Which versions are affected by CVE-2026-31831?

It affects 1 product.

Products include Tautulli Tautulli.

How do I fix CVE-2026-31831?

No fix has been published for CVE-2026-31831 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-31831 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31831 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Tautulli

• CVE-2025-58762 Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent Critical 9.1
• CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint High 8.6
• CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy` High 8.6
• CVE-2025-58763 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection High 8.1
• CVE-2026-28505 Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xp55-2pf4-fv8m.