Tautulli - Path Traversal (CVE-2026-31831)

CVE-2026-31831 is a high-severity path traversal vulnerability in Tautulli versions before 2.17.0. The flaw in the /newsletter/image/images API endpoint allows unauthenticated remote attackers to read arbitrary files from the application server’s filesystem, potentially exposing sensitive configuration data, credentials, and other confidential information.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of August 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-31831 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2026-31831 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target the unauthenticated /newsletter/image/images endpoint with URL-encoded parent-directory traversal sequences to escape the intended image directory and read local files. Detection should identify traversal patterns such as ..%2F in this path, particularly when the response contains Tautulli configuration markers like [General], [PMS], or pms_identifier.