CVE-2025-58763: Tautulli remote code execution (CVSS 8.0)

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from GitHub and installed manually. When Tautulli is cloned directly from GitHub and installed manually, the application manages updates and versioning through calls to the `git` command. In the code, this is performed through the `runGit` function in `versioncheck.py`. Since `shell=True` is passed to `subproces.Popen`, this call is vulnerable to subject to command injection, as shell characters within arguments will be passed to the underlying shell. A concrete location where this can be triggered is in the `checkout_git_branch` endpoint. This endpoint stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys without sanitization. Downstream, these keys are then fetched and passed directly into `runGit` using a format string. Hence, code execution can be obtained by using `$()` interpolation in a command. Version 2.16.0 contains a fix for the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredHigh

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

Tautulli< 2.16.0

Remediation

Fixed in

Tautulli≥ 2.16.0

Patch & vendor advisories

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-jrm9-r57q-6cvf

References

https://github.com/Tautulli/Tautulli/security/advisories/GHSA-jrm9-r57q-6cvfExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-58763 being actively exploited?

CVE-2025-58763 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.68%.

How severe is CVE-2025-58763?

CVE-2025-58763 has a CVSS 3.1 base score of 8.0, rated high. EPSS estimates a 1.68% probability of exploitation.

Which products are affected by CVE-2025-58763?

Affected products include Tautulli.

How do I fix CVE-2025-58763?

Upgrade affected software to a fixed version, for example Tautulli 2.16.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-58763 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo