Tautulli CVE-2026-31831

No special conditions — remote unauthenticated exploitation against Tautulli versions prior to 2.17.0. Attacker accesses the /newsletter/image/images API endpoint with path traversal payloads to read arbitrary files from the server filesystem.

This vulnerability presents significant real-world risk due to the confluence of multiple high-risk factors from the CVSS 4.0 vector analysis. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no authentication (PR:N) or user interaction (UI:N), meaning any network-accessible instance can be trivially exploited via simple HTTP requests. The confidentiality impact is high (VC:H), enabling disclosure of configuration files, credentials, database contents, or other sensitive server data. While no active exploitation is confirmed (not present in CISA KEV), the public GitHub security advisory and tagged release make technical details readily available for weaponization. EPSS data was not provided, but path traversal vulnerabilities in internet-facing applications historically show rapid exploitation post-disclosure. The SSVC framework would classify this as requiring expedited remediation: exploitation is straightforward (automatable via simple HTTP manipulation), technical impact is partial (confidentiality breach), and the product serves media infrastructure that may contain personal viewing data. Organizations running Tautulli in production-especially internet-exposed instances-face immediate risk of reconnaissance, credential harvesting, and lateral movement preparation. The lack of authentication requirement transforms this from a moderate insider threat to a critical external attack surface issue.

An unauthenticated attacker scans for internet-exposed Tautulli instances (commonly running on ports 8181 or custom ports) and crafts HTTP requests to the /newsletter/image/images endpoint with path traversal payloads such as '../../../etc/passwd' or '../config/config.ini'. The vulnerable endpoint processes the malicious path without validation, returning the contents of arbitrary files readable by the Tautulli process user. The attacker systematically retrieves sensitive configuration files containing Plex authentication tokens, database credentials, API keys for notification services, or user viewing history data. This information enables credential stuffing attacks against Plex accounts, unauthorized access to media libraries, or reconnaissance for broader network compromise if Tautulli runs with elevated privileges or alongside other infrastructure components.