PT-2025-36569 · Plex+1 · Plex Media Server+1

D-Xuan · Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-58762

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0

Description: Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. An attacker with administrative access can exploit the pms image proxy endpoint to write arbitrary Python scripts into the application filesystem. This can be achieved by manipulating the img parameter and the img format parameter within a pms image proxy request, leveraging path traversal vulnerabilities to specify a desired filename. The attacker controls the Plex Media Server (PMS) and can provide arbitrary content, which is then written to the specified file. Subsequently, the attacker can utilize the Script notification agent to execute the written script, resulting in remote code execution on the application server.

Recommendations: Upgrade to version 2.16.0.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-58762

GHSA-PXHR-29GV-4J8V

Affected Products

Plex Media Server

Tautulli

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58762.json · Exploit
• https://github.com/Tautulli/Tautulli/commit/26e6b328112eb2cf35c164f981e0718f3a3d31a7 · Patch
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-pxhr-29gv-4j8v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58762 · Security Note
• https://twitter.com/CVEnew/status/1965509595050451186 · Twitter Post
• https://reddit.com/r/Tautulli/comments/1nc5wew/important_security_update_20250908 · Reddit Post