Tautulli up to 2.16.x Endpoint /pms_image_proxy img server-side request forgery

Summaryinfo

A vulnerability was found in Tautulli up to 2.16.x and classified as critical. Impacted is an unknown function of the file /pms_image_proxy of the component Endpoint. Such manipulation of the argument img leads to server-side request forgery. This vulnerability is referenced as CVE-2026-31804. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Tautulli up to 2.16.x. Affected by this issue is an unknown code of the file /pms_image_proxy of the component Endpoint. The manipulation of the argument img with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-31804 since 03/09/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.17.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Tautulli

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16

Website

• Product: https://github.com/Tautulli/Tautulli/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion