CVE-2026-31831

8.7 highEPSS 2.0%

High (8.7) in tautulli tautulli. EPSS 2.0% chance of exploitation in the next 30 days.

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-23
Published: 2026-03-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tautulli:tautulli

References

https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m

Check your stack JSON