Which versions of Python are affected by CVE-2026-31831?

Tautulli versions prior to 2.17.0 contain an unauthenticated path traversal vulnerability in the newsletter image API that allows attackers to read arbitrary files from the server, creating immediate…. A patch is available.

How to fix or mitigate CVE-2026-31831?

Within 24 hours: Inventory all Tautulli deployments and document current versions. Within 7 days: Apply vendor patch by upgrading all affected instances to Tautulli 2.17.0 or later. Within 30 days: Conduct file system audit to determine if sensitive files were accessed, review access logs for suspicious /newsletter/image/images requests, and validate credential rotation for any exposed system accounts.

Python CVE-2026-31831

Q: What is the CVSS score of CVE-2026-31831?

CVE-2026-31831 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17192 HIGH

Relative Path Traversal (CWE-23)

2026-03-30 GitHub_M

Python Path Traversal

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:10 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.17.0

EUVD ID Assigned

Mar 30, 2026 - 19:45 euvd

EUVD-2026-17192

Analysis Generated

Mar 30, 2026 - 19:45 vuln.today

CVE Published

Mar 30, 2026 - 19:42 nvd

HIGH 8.7

DescriptionGitHub Advisory

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been patched in version 2.17.0.

AnalysisAI

Path traversal in Tautulli's /newsletter/image/images API endpoint allows unauthenticated remote attackers to read arbitrary files from the server filesystem. Tautulli, a Python-based monitoring tool for Plex Media Server, is affected in all versions prior to 2.17.0. The vulnerability carries a CVSS 4.0 score of 8.7 with network attack vector, low complexity, and no authentication required (PR:N), enabling trivial exploitation for sensitive information disclosure. No active exploitation confirmed at time of analysis, though the unauthenticated nature and public disclosure significantly elevate real-world risk.

Technical ContextAI

This vulnerability exploits improper input validation in Tautulli's newsletter image handling functionality, classified as CWE-23 (Relative Path Traversal). The /newsletter/image/images API endpoint fails to adequately sanitize user-supplied file paths, enabling directory traversal sequences (such as '../') to escape the intended directory and access arbitrary filesystem locations. As a Python-based application, Tautulli likely uses standard file I/O operations that, without proper path canonicalization or allowlist validation, permit attackers to construct requests that traverse up the directory tree. The affected component appears to be designed for serving newsletter images but inadvertently exposes a file read primitive with no authentication gate. The CPE identifier cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:* confirms this affects the core Tautulli application across all versions preceding the remediation release.

RemediationAI

Upgrade immediately to Tautulli version 2.17.0 or later, which contains patches addressing the path traversal vulnerability in the newsletter image endpoint. The vendor-released fix is available at https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 with installation instructions for Python-based deployments. For environments unable to immediately upgrade, implement network-level access controls to restrict the /newsletter/image/images endpoint to trusted IP ranges or disable newsletter functionality entirely if not required. Review web server and application firewall logs for suspicious requests containing directory traversal patterns such as dot-dot-slash sequences, URL encoding variations, or attempts to access system files like /etc/passwd or configuration files. After patching, conduct filesystem audits to identify any unauthorized access that may have occurred prior to remediation, particularly examining application configuration files, database credentials, and Plex authentication tokens.