Description
Tautulli 在 2.17.0 版本之前，/newsletter/image/images端点在没有进行包含验证的情况下将用户控制的路径段连接到新闻通讯图片目录。此端点不需要身份验证，允许未经身份验证的攻击者执行目录遍历并读取服务器进程可访问的任意文件。读取config/config.ini 会泄露 API 密钥、哈希管理员密码、JWT 令牌密钥和 Plex Media Server 令牌。2.17.0版本已修复此问题。
Tautulli <= 2.16.1 未授权路径遍历漏洞(CVE-2026-31831)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Tautulli/Tautulli/releases
https://nvd.nist.gov/vuln/detail/CVE-2026-31831
https://app.opencve.io/cve/CVE-2026-31831
https://www.reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327/
https://cert.kenet.or.ke/cve-2026-31831-tautulli-unauthenticated-path-traversal-newsletterimageimages-endpoint
https://vulners.com/cve/CVE-2026-31831