CVE-2025-58763
- Source
- https://cve.org/CVERecord?id=CVE-2025-58763
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58763.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-58763
- Aliases
-
- GHSA-jrm9-r57q-6cvf
- Published
- 2025-09-09T20:13:44.797Z
- Modified
- 2026-04-10T05:32:59.564809Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
- Details
-
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from GitHub and installed manually. When Tautulli is cloned directly from GitHub and installed manually, the application manages updates and versioning through calls to the
gitcommand. In the code, this is performed through therunGitfunction inversioncheck.py. Sinceshell=Trueis passed tosubproces.Popen, this call is vulnerable to subject to command injection, as shell characters within arguments will be passed to the underlying shell. A concrete location where this can be triggered is in thecheckout_git_branchendpoint. This endpoint stores a user-supplied remote and branch name into theGIT_REMOTEandGIT_BRANCHconfiguration keys without sanitization. Downstream, these keys are then fetched and passed directly intorunGitusing a format string. Hence, code execution can be obtained by using$()interpolation in a command. Version 2.16.0 contains a fix for the issue. - Database specific
{ "cwe_ids": [ "CWE-78" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58763.json" }- References
Affected packages
Git / github.com/tautulli/tautulli
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tautulli/tautulli
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed