CVE-2026-31831CWE-23

Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

High · published March 30, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01867 · 79.1th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-03-30T19:42Z
EPSS history
Timeline
  • 30 MAR 19:42Z
    Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
    cvelistv5