CVE-2025-58763

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from GitHub and installed manually. When Tautulli is cloned directly from GitHub and installed manually, the application manages updates and versioning through calls to the `git` command. In the code, this is performed through the `runGit` function in `versioncheck.py`. Since `shell=True` is passed to `subproces.Popen`, this call is vulnerable to subject to command injection, as shell characters within arguments will be passed to the underlying shell. A concrete location where this can be triggered is in the `checkout_git_branch` endpoint. This endpoint stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys without sanitization. Downstream, these keys are then fetched and passed directly into `runGit` using a format string. Hence, code execution can be obtained by using `$()` interpolation in a command. Version 2.16.0 contains a fix for the issue.

• CWE-78

• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-jrm9-r57q-6cvfExploit, Vendor Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58758TinyEnv is an environment variable loader for PHP applicatio…7.3
• CVE-2025-58759TinyEnv is an environment variable loader for PHP applicatio…6.5
• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58760Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8
• CVE-2025-58765wabac.js provides a full web archive replay system, or 'wayb…7.1
• CVE-2025-58766Dyad is a local AI app builder. A critical security vulnerab…9
• CVE-2025-58767REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 …5.3
• CVE-2025-58768DeepChat is a smart assistant uses artificial intelligence. …9.6
• CVE-2025-58769auth0-PHP is an SDK for Auth0 Authentication and Management …3.3