CVE-2025-58763

CVE-2025-58763 is a command injection vulnerability in Tautulli v2.15.3 and prior, a Python-based monitoring tool for Plex Media Server. This flaw allows attackers with administrative privileges to achieve remote code execution on the application server. The vulnerability stems from unsanitized user input being passed to the `git` command with `shell=True` enabled, specifically when Tautulli is manually installed from GitHub. The vulnerability is rated as High severity (CVSS 7.2), indicating a network-based attack with low complexity, requiring high privileges, and leading to complete compromise of confidentiality, integrity, and availability. Its EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of vulnerabilities.