CVE-2025-58762
Full vulnerability record from the local CVENow database.
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Script` notification agent. If an attacker with administrative access changes the URL of the PMS to a server they control, they can then abuse the `pms_image_proxy` to obtain a file write into the application filesystem. This can be done by making a `pms_image_proxy` request with a URL in the `img` parameter and the desired file name in the `img_format` parameter. Tautulli then uses a hash of the desired metadata together with the `img_format` in order to construct a file path. Since the attacker controls `img_format` which occupies the end of the file path, and `img_format` is not sanitised, the attacker can then use path traversal characters to specify filename of their choosing. If the specified file does not exist, Tautaulli will then attempt to fetch the image from the configured PMS. Since the attacker controls the PMS, they can return arbitrary content in response to this request, which will then be written into the specified file. An attacker can write an arbitrary python script into a location on the application file system. The attacker can then make use of the built-in `Script` notification agent to run the local script, obtaining remote code execution on the application server. Users should upgrade to version 2.16.0 to receive a patch.
View original CVE JSON
{
"id": "CVE-2025-58762",
"sourceIdentifier": "[email protected]",
"published": "2025-09-09T20:15:49.950",
"lastModified": "2026-10-19T17:10:00.173",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Script` notification agent. If an attacker with administrative access changes the URL of the PMS to a server they control, they can then abuse the `pms_image_proxy` to obtain a file write into the application filesystem. This can be done by making a `pms_image_proxy` request with a URL in the `img` parameter and the desired file name in the `img_format` parameter. Tautulli then uses a hash of the desired metadata together with the `img_format` in order to construct a file path. Since the attacker controls `img_format` which occupies the end of the file path, and `img_format` is not sanitised, the attacker can then use path traversal characters to specify filename of their choosing. If the specified file does not exist, Tautaulli will then attempt to fetch the image from the configured PMS. Since the attacker controls the PMS, they can return arbitrary content in response to this request, which will then be written into the specified file. An attacker can write an arbitrary python script into a location on the application file system. The attacker can then make use of the built-in `Script` notification agent to run the local script, obtaining remote code execution on the application server. Users should upgrade to version 2.16.0 to receive a patch."
},
{
"lang": "es",
"value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. En Tautulli v2.15.3 y versiones anteriores, un atacante con acceso administrativo puede usar el endpoint 'pms_image_proxy' para escribir scripts Python arbitrarios en el sistema de archivos de la aplicación. Esto lleva a la ejecución remota de código cuando se combina con el agente de notificación 'Script'. Si un atacante con acceso administrativo cambia la URL del PMS a un servidor que controla, puede entonces abusar del 'pms_image_proxy' para obtener una escritura de archivo en el sistema de archivos de la aplicación. Esto se puede hacer realizando una solicitud 'pms_image_proxy' con una URL en el parámetro 'img' y el nombre de archivo deseado en el parámetro 'img_format'. Tautulli luego usa un hash de los metadatos deseados junto con el 'img_format' para construir una ruta de archivo. Dado que el atacante controla 'img_format', que ocupa el final de la ruta de archivo, y 'img_format' no está sanitizado, el atacante puede entonces usar caracteres de salto de ruta para especificar el nombre de archivo de su elección. Si el archivo especificado no existe, Tautulli intentará entonces obtener la imagen del PMS configurado. Dado que el atacante controla el PMS, puede devolver contenido arbitrario en respuesta a esta solicitud, que luego se escribirá en el archivo especificado. Un atacante puede escribir un script Python arbitrario en una ubicación del sistema de archivos de la aplicación. El atacante puede entonces hacer uso del agente de notificación 'Script' incorporado para ejecutar el script local, obteniendo ejecución remota de código en el servidor de aplicaciones. Los usuarios deben actualizar a la versión 2.16.0 para recibir un parche."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Tautulli",
"product": "Tautulli",
"versions": [
{
"version": "< 2.16.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-10T20:20:25.851914Z",
"id": "CVE-2025-58762",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-73"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.16.0",
"matchCriteriaId": "2DC34660-238E-4602-816E-D7DA8D91E923"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Tautulli/Tautulli/commit/26e6b328112eb2cf35c164f981e0718f3a3d31a7",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-pxhr-29gv-4j8v",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
}
]
}