Overview
In this blog post, we will detail an important vulnerability that affects Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The vulnerability, tagged as CVE-2025-58763, involves command injection that can lead to remote code execution. The issue is particularly pertinent to administrators who have cloned Tautulli directly from GitHub and installed it manually. Given the potential for system compromise or data leakage, understanding and addressing this vulnerability is of high importance.
Vulnerability Summary
CVE ID: CVE-2025-58763
Severity: High (CVSS Score 8.0)
Attack Vector: Network
Privileges Required: Administrator
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tautulli | v2.15.3 and prior
How the Exploit Works
The vulnerability lies in the `runGit` function in `versioncheck.py` of the Tautulli application. This is because `shell=True` is passed to `subproces.Popen`, making this call susceptible to command injection. An attacker can trigger the vulnerability at the `checkout_git_branch` endpoint, which unsanitizedly stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys. These keys are fetched and passed directly into `runGit` using a format string, thus allowing for code execution through `$()` interpolation in a command.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. This is a pseudocode representation of an attacker-supplied evil branch name for triggering the exploit.
GIT_BRANCH = "$(malicious_command)"
checkout_git_branch(GIT_REMOTE, GIT_BRANCH)In the above example, `malicious_command` is the command that the attacker wants to execute on the server. When `checkout_git_branch` is called, it will trigger the `runGit` function with the malicious command, leading to command injection and potentially compromising the server.
How to Mitigate the Vulnerability
To mitigate this vulnerability, users are advised to apply the vendor patch. Tautulli version 2.16.0 contains a fix for this issue. As a temporary mitigation measure, users can also use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS). It is also recommended to avoid cloning Tautulli directly from GitHub and installing it manually, as this is a prerequisite for the vulnerability.
