What is CVE-2025-58762?

CVE-2025-58762 is a critical-severity vulnerability in Tautulli, classified under External Control of File Name or Path. CVSS score: 9.1/10. Published 2025-09-09.

How severe is CVE-2025-58762?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Tautulli

CVE-2025-58762

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the applic…

EPSS: 0.008 (50.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Tautulli — versions < 2.16.0

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-58762?: CVE-2025-58762 is a critical-severity vulnerability in Tautulli, classified under External Control of File Name or Path. CVSS score: 9.1/10. Published 2025-09-09.
How severe is CVE-2025-58762?: Critical severity. CVSS v3 base score is 9.1 out of 10.