CVE-2026-31831: 
NixOS vulnerability analysis and mitigation

CVE-2026-31831 is an unauthenticated path traversal vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The /newsletter/image/images API endpoint fails to properly sanitize user-supplied path input, allowing unauthenticated remote attackers to read arbitrary files from the server's filesystem. All versions up to and including 2.16.1 are affected; the issue was patched in version 2.17.0, released March 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-23 (Relative Path Traversal), where the /newsletter/image/images endpoint accepts a filename parameter without properly neutralizing .. sequences, allowing attackers to escape the intended directory (GitHub Advisory). The advisory notes this is essentially the same class of flaw as CVE-2025-58760 but affecting a different endpoint. No authentication is required, and exploitation is straightforward via URL-encoded path traversal sequences (e.g., ..%2F) sent in a standard HTTP GET request. The attack vector is network-accessible, requires no privileges or user interaction, and has low attack complexity.

Successful exploitation allows an unauthenticated attacker to exfiltrate arbitrary files from the Tautulli server's filesystem. Particularly sensitive targets include config.ini (containing the hashed admin password, JWT token secret, and Plex Media Server token and connection details) and tautulli.db (an SQLite database containing active JWT tokens). If the admin password hash is cracked or a valid JWT token is extracted from the database, an attacker can escalate to full administrative control over the Tautulli application and potentially the connected Plex Media Server (GitHub Advisory).

A public proof-of-concept exploit is available in the official GitHub security advisory, consisting of concrete wget commands demonstrating file exfiltration via URL-encoded path traversal (GitHub Advisory). The EPSS score is approximately 0.092%, indicating a relatively low but non-negligible probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability was reported by researcher JakePeralta7 and disclosed responsibly through GitHub's security advisory process.

1. Reconnaissance: Identify internet-facing Tautulli instances (versions ≤2.16.1) using search engines like Shodan or Censys, or by scanning for the default Tautulli web interface port (typically 8181).
2. Confirm vulnerability: Send a test request to the /newsletter/image/images endpoint to confirm the instance is running a vulnerable version.
3. Craft path traversal payload: Construct a URL with URL-encoded ..%2F sequences to traverse out of the intended image directory. For Docker-based deployments, the relative depth to reach the config directory is typically six levels up.
4. Exfiltrate sensitive files: Execute the following commands to retrieve the configuration file and database:

   wget http://<tautulli_ip>:<tautulli_port>/newsletter/image/images/..%2F..%2F..%2F..%2F..%2F..%2Fconfig%2Fconfig.ini -O config.ini
   wget http://<tautulli_ip>:<tautulli_port>/newsletter/image/images/..%2F..%2F..%2F..%2F..%2F..%2Fconfig%2Ftautulli.db -O tautulli.db

5. Extract credentials: Parse config.ini for the hashed admin password, JWT secret, and Plex token. Query tautulli.db for active JWT session tokens.
6. Privilege escalation: Use a cracked password or a valid JWT token to authenticate to the Tautulli admin interface and gain full administrative control (GitHub Advisory).

• Network: Unusual HTTP GET requests to /newsletter/image/images/ containing URL-encoded path traversal sequences such as ..%2F or %2E%2E%2F; requests targeting paths like config%2Fconfig.ini or config%2Ftautulli.db.
• Logs: Tautulli access logs showing requests to the /newsletter/image/images endpoint with encoded directory traversal patterns from unexpected or external IP addresses; HTTP 200 responses to such requests indicating successful file reads.
• File System: Unexpected access timestamps on config.ini or tautulli.db files; evidence of these files being read outside of normal application operation.
• Authentication: Unexpected admin logins or API calls using JWT tokens not associated with known user sessions, potentially indicating token theft and reuse (GitHub Advisory).

The primary remediation is to upgrade Tautulli to version 2.17.0 or later, which patches this vulnerability along with several other security issues (CVE-2026-28505, CVE-2026-31799, CVE-2026-31804, CVE-2026-32275) (Tautulli v2.17.0 Release). If immediate patching is not possible, implement network-level access controls to restrict access to the Tautulli web interface to trusted IP addresses only, preventing unauthenticated external access to the /newsletter/image/images endpoint. Additionally, consider placing Tautulli behind an authenticated reverse proxy to add an authentication layer in front of all endpoints (GitHub Advisory).

The vulnerability was published by Tautulli maintainer JonnyWong16 via GitHub's security advisory system and credited to researcher JakePeralta7. The v2.17.0 release notes explicitly flag multiple CVEs fixed in the release and strongly encourage all users on versions ≤2.16.1 to update immediately (Tautulli v2.17.0 Release). Red Hat has also tracked the CVE in their security database (Red Hat CVE). No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability disclosure channels.