PT-2025-36570 · Plex+1 · Plex Media Server+1

D-Xuan · Published 2025-09-09 · Updated 2025-09-18 · CVE-2025-58763

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0

Description: Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. A command injection issue in the runGit function within versioncheck.py allows attackers with administrative privileges to achieve remote code execution on the application server. This requires the application to have been cloned from GitHub and installed manually. The vulnerability occurs because shell=True is passed to subproces.Popen, making the call susceptible to command injection through shell characters in arguments. The checkout git branch API endpoint is a concrete trigger point, storing user-supplied remote and branch names into the GIT REMOTE and GIT BRANCH configuration keys without sanitization, which are then passed directly into runGit using a format string. Code execution can be obtained by using $() interpolation in a command.

Recommendations: Update to Tautulli version 2.16.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-58763

GHSA-JRM9-R57Q-6CVF

Affected Products

Plex Media Server

Tautulli

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58763.json · Exploit
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-jrm9-r57q-6cvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58763 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58763 · Vendor Advisory
• https://t.me/cveNotify/135880 · Telegram Post
• https://twitter.com/CVEnew/status/1965557718501974151 · Twitter Post
• https://reddit.com/r/Tautulli/comments/1nc5wew/important_security_update_20250908 · Reddit Post