{"id":76010,"date":"2025-09-20T02:07:35","date_gmt":"2025-09-20T02:07:35","guid":{"rendered":""},"modified":"2025-10-14T17:55:25","modified_gmt":"2025-10-14T23:55:25","slug":"cve-2025-58763-command-injection-vulnerability-in-tautulli","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-58763-command-injection-vulnerability-in-tautulli\/","title":{"rendered":"CVE-2025-58763: Command Injection Vulnerability in Tautulli<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In this blog post, we will detail an important vulnerability that affects Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The vulnerability, tagged as CVE-2025-58763, involves command injection that can lead to remote code execution. The issue is particularly pertinent to administrators who have cloned Tautulli directly from GitHub and installed it manually. Given the potential for system<\/a> compromise or data leakage, understanding and addressing this vulnerability is of high importance.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-58763
\nSeverity: High (CVSS Score 8.0)
\nAttack Vector: Network
\nPrivileges Required: Administrator
\nUser Interaction: Required
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Tautulli | v2.15.3<\/a> and prior<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the `runGit` function<\/a> in `versioncheck.py` of the Tautulli application. This is because `shell=True` is passed to `subproces.Popen`, making this call susceptible to command injection<\/a>. An attacker can trigger the vulnerability<\/a> at the `checkout_git_branch` endpoint, which unsanitizedly stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys. These keys are fetched and passed directly into `runGit` using a format string, thus allowing for code execution<\/a> through `$()` interpolation in a command.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited. This is a pseudocode representation of an attacker-supplied evil branch name for triggering the exploit.<\/p>\n

GIT_BRANCH = \"$(malicious_command)\"\ncheckout_git_branch(GIT_REMOTE, GIT_BRANCH)<\/code><\/pre>\n
In the above example, `malicious_command` is the command that the attacker wants to execute<\/a> on the server. When `checkout_git_branch` is called, it will trigger the `runGit` function with the malicious command, leading to command injection and potentially<\/a> compromising the server.<\/p>\n
How to Mitigate the Vulnerability<\/strong><\/p>\n
To mitigate this vulnerability, users are advised to apply the vendor patch. Tautulli version 2.16.0 contains a fix for this issue. As a temporary mitigation measure, users can also use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS). It is also recommended to avoid cloning Tautulli directly from GitHub and installing it manually, as this is a prerequisite for the vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In this blog post, we will detail an important vulnerability that affects Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The vulnerability, tagged as CVE-2025-58763, involves command injection that can lead to remote code execution. The issue is particularly pertinent to administrators who have cloned Tautulli directly from GitHub and installed […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[79],"product":[],"attack_vector":[78,80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-76010","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-github","attack_vector-injection","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t