Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tautulli | Tautulli | < 2.17.0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Tautulli <= 2.16.1 - Path Traversal http/cves/2026/CVE-2026-31831.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.