Tautulli CVE-2025-58763

Two concrete prerequisites must both hold: (1) the attacker must possess Tautulli administrative privileges (CVSS PR:H), granting access to the checkout_git_branch endpoint that writes the GIT_REMOTE and GIT_BRANCH configuration keys; and (2) the instance must have been installed by cloning the Tautulli GitHub repository and run manually, so that the git-based update/versioning code path (runGit in versioncheck.py, invoked with subprocess.Popen shell=True) is active - packaged, Docker, or non-git installations do not reach this code and are not exploitable. The exact trigger is injecting $() shell interpolation into the remote or branch name, which is later substituted into a format string and passed to the shell. Limiting factors: required administrator authentication and the non-default manual-git deployment mode substantially narrow the exploitable population; affected versions are 2.15.3 and prior, fixed in 2.16.0.

Signals are mixed and net out to a moderate, conditional priority rather than an urgent one. CVSS 3.1 base is 7.2 (High) with AV:N/AC:L but critically PR:H - exploitation requires existing administrative access to Tautulli, so this is a privilege-escalation-to-RCE primitive for an already-trusted admin, not an unauthenticated internet-facing RCE. The description adds a second gating condition the CVSS vector does not capture: the instance must have been cloned from GitHub and installed manually (so that git-based update logic is active), which excludes packaged/Docker/one-click deployments. EPSS is low at 0.37% (59th percentile), consistent with the narrow preconditions, and the vulnerability is NOT on CISA KEV, so there is no confirmed active exploitation. A public exploit path is documented in the GitHub Security Advisory (POC available). Bottom line: the combination of required admin privileges plus a non-default manual-git install meaningfully suppresses real-world risk below what the 7.2 score alone implies; EPSS being low despite POC availability supports treating this as a patch-in-normal-cycle item for the subset of manually-cloned deployments, not a drop-everything emergency. One explicit caveat: the CVSS vector marks AC:L, but the manual-GitHub-install prerequisite is a real condition outside the attacker's control - verify your deployment method before scoring this against your fleet.

An attacker who already holds (or has phished/credential-stuffed) a Tautulli administrator account targets an instance that was installed by cloning the GitHub repo. Using the checkout_git_branch endpoint, they store a malicious GIT_REMOTE or GIT_BRANCH value containing $() shell interpolation, which is later passed unsanitized into the runGit function where subprocess.Popen runs with shell=True, yielding arbitrary command execution as the Tautulli service account. A public advisory (GHSA-jrm9-r57q-6cvf) documents the mechanism, so a working exploit path is available.