CVE-2026-31831 PoC — Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31831.yaml

Associated Vulnerability

Title:Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint (CVE-2026-31831)
Description:Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

Description

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →