CVE-2026-31831highCWE-23

CVE-2026-31831: falha de alta gravidade em Tautulli

Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Tautulli

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.7epss 2.0%
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Tautulli · Tautulli
CVEs relacionadas — Tautulli

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58763HIGHTautulli vulnerable to Authenticated Remote Code Execution via Command InjectionEPSS 1.7%CVE-2025-58762CRITICALTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agentEPSS 0.8%CVE-2025-58761HIGHTautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`EPSS 0.7%CVE-2025-58760HIGHTautulli vulnerable to Unauthenticated Path Traversal in `/image` endpointEPSS 0.6%CVE-2026-49995MEDIUMTautulli: Stored Cross-Site Scripting (XSS) in the newsletterEPSS 0.6%CVE-2026-52835HIGHTautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_databaseEPSS 0.6%