PT-2026-2395 · Tdarr · Tdarr

Sam Smith · Published 2026-01-13 · Updated 2026-01-29 · CVE-2022-50919

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tdarr version 2.00.15

Description The software contains an unauthenticated remote code execution issue in its Help terminal. An attacker can inject and chain arbitrary commands due to a lack of input filtering. Specifically, an attacker can exploit this by chaining commands such as --help; curl .py | python to execute remote code without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-50919

Affected Products

Tdarr

References · 7

• 🔥 https://exploit-db.com/exploits/50822 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50919 · Security Note
• https://vulncheck.com/advisories/tdarr-command-injection · Note
• https://twitter.com/CVEnew/status/2011759612924498225 · Twitter Post
• https://t.me/cveNotify/150297 · Telegram Post
• https://tdarr.io · Note