An OS command injection vulnerability in Tautulli versions prior to 2.16.0 allows authenticated administrative users to gain remote code execution on the underlying server.

This is an OS command injection vulnerability (CWE-78) located in the runGit function within versioncheck.py. An attacker with administrative privileges can inject malicious commands via the checkout_git_branch endpoint by supplying crafted input that is passed unsanitized to a shell execution call.

Successful exploitation of this vulnerability grants an attacker full remote code execution capabilities on the host system. Given the application's role in monitoring Plex Media Server, this could lead to total compromise of the server environment, including unauthorized data access and lateral movement within the network. While the CVSS score of 8.0 indicates high severity, the requirement for administrative privileges limits the initial attack surface to existing authorized users.

Immediate Action: Update Tautulli to version 2.16.0 or later immediately to incorporate the necessary input sanitization and command execution hardening.

Proactive Monitoring: Review application logs for suspicious activity involving branch or remote configuration changes, particularly entries that appear to contain shell metacharacters such as dollar signs or parentheses.

Compensating Controls: Restrict administrative access to the Tautulli interface to trusted internal networks only and ensure the service is running with the least privilege necessary on the host operating system.

Public Exploit Available: Unknown.

The risk of remote code execution on the application host necessitates prompt action. Administrators should verify their installation method, as the vulnerability specifically affects manual GitHub clones, and prioritize the upgrade to version 2.16.0. Restricting administrative access is a critical defense-in-depth measure to prevent unauthorized users from reaching the vulnerable endpoint.