PT-2025-53753 · Unknown+1 · Tugtainer-Agent+1

Yasinseyhun · Published 2025-12-24 · Updated 2026-02-20 · CVE-2025-69201

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.15.1

Description Tugtainer is a self-hosted application designed for automating updates of docker containers. A flaw exists where arbitrary arguments can be injected. This occurs through the POST api/command/run endpoint of the tugtainer-agent. The api/command/run endpoint is susceptible to command injection due to improper input validation. The vulnerable parameter is not explicitly identified.

Recommendations Update Tugtainer to version 1.15.1 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-00421

CVE-2025-69201

GHSA-GRC3-8W5X-G54Q

Affected Products

Tugtainer

Tugtainer-Agent

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69201.json · Exploit
• https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831 · Patch
• https://github.com/Quenary/tugtainer/pull/88 · Patch
• https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69201 · Security Note
• https://bdu.fstec.ru/vul/2026-00421 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69201 · Vendor Advisory
• https://github.com/Quenary/tugtainer/releases/tag/v1.15.1 · Note
• https://twitter.com/vuldb/status/2005934947148947466 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2005685582433857752 · Twitter Post
• https://t.me/cveNotify/152604 · Telegram Post
• https://t.me/CVEtracker/40840 · Telegram Post