Tautulli CVE-2025-58762

Requires pre-existing Tautulli ADMINISTRATIVE access (CVSS PR:H confirms this): the attacker must be able to change the configured Plex Media Server (PMS) URL to a server they control. Exploitation specifically abuses the pms_image_proxy endpoint, supplying the image source in the img parameter and an unsanitized img_format parameter that forms the end of the constructed file path, allowing path-traversal characters to control the written filename. Achieving RCE additionally requires the built-in Script notification agent to be usable to execute the written Python file. Limiting factors: this is NOT remotely exploitable by unauthenticated users - the admin-access requirement is the primary constraint, meaning realistic risk is confined to scenarios of compromised admin credentials, malicious operators, or improperly exposed/over-shared admin consoles. Affected: Tautulli v2.15.3 and earlier; fixed in 2.16.0.

This is a genuine but conditional risk. The CVSS vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms a network-exploitable, low-complexity flaw that nonetheless REQUIRES high privileges (PR:H) - the description corroborates this, stating the attacker needs 'administrative access' to Tautulli to change the PMS URL and abuse the pms_image_proxy endpoint. The signals are internally consistent (CVSS PR:H matches the description's admin-only prerequisite), so there is no contradiction to flag. EPSS is low at 0.61% (70th percentile), and the vulnerability is NOT in CISA KEV, indicating no confirmed widespread active exploitation. However, publicly available exploit code exists via the GitHub Security Advisory (GHSA-pxhr-29gv-4j8v). The low EPSS combined with POC availability and an admin-access precondition suggests this is a privilege-escalation-to-RCE post-authentication issue rather than a mass-exploitable perimeter bug. Real priority is MODERATE: it matters most where Tautulli admin credentials could be compromised or where a lower-trust operator should not be able to reach code execution, but it is not a drive-by unauthenticated threat. The SSVC framing would lean toward lower urgency (exploitation not automatable, requires prior admin control), tempering the high technical impact (full RCE).

An attacker who has obtained Tautulli administrative access (or a malicious/over-privileged admin operator) reconfigures the Plex Media Server URL to point at an attacker-controlled server, then sends a pms_image_proxy request supplying a crafted img_format containing path-traversal characters to write an attacker-supplied Python script anywhere in the application filesystem. They then invoke the built-in Script notification agent to execute that script, achieving remote code execution on the Tautulli host. Public exploit code for this chain is available via the vendor's GitHub Security Advisory.