CVE-2025-69201 - Vulnerability Details - OpenCVE

Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831
https://github.com/Quenary/tugtainer/pull/88
https://github.com/Quenary/tugtainer/releases/tag/v1.15.1
https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q

History

Mon, 29 Dec 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 29 Dec 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.
Title		Tugtainer has RCE in Agent Command Execution Api
Weaknesses		CWE-77
References		https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831 https://github.com/Quenary/tugtainer/pull/88 https://github.com/Quenary/tugtainer/releases/tag/v1.15.1 https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q
Metrics		cvssV4_0 `{'score': 8.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-12-29T15:51:41.461Z

Updated: 2025-12-29T16:50:49.919Z

Reserved: 2025-12-29T14:47:58.453Z

Link: CVE-2025-69201

Vulnrichment

Updated: 2025-12-29T16:42:41.900Z

NVD

Status : Received

Published: 2025-12-29T16:15:43.940

Modified: 2025-12-29T16:15:43.940

Link: CVE-2025-69201

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69201", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T14:47:58.453Z", "datePublished": "2025-12-29T15:51:41.461Z", "dateUpdated": "2025-12-29T16:50:49.919Z"}, "containers": {"cna": {"title": "Tugtainer has RCE in Agent Command Execution Api", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q"}, {"name": "https://github.com/Quenary/tugtainer/pull/88", "tags": ["x_refsource_MISC"], "url": "https://github.com/Quenary/tugtainer/pull/88"}, {"name": "https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831", "tags": ["x_refsource_MISC"], "url": "https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831"}, {"name": "https://github.com/Quenary/tugtainer/releases/tag/v1.15.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Quenary/tugtainer/releases/tag/v1.15.1"}], "affected": [{"vendor": "Quenary", "product": "tugtainer", "versions": [{"version": "< 1.15.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-29T15:51:41.461Z"}, "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue."}], "source": {"advisory": "GHSA-grc3-8w5x-g54q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-29T16:42:38.826048Z", "id": "CVE-2025-69201", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-29T16:50:49.919Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-29T16:42:38.826048Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-29T16:42:41.900Z"}}], "cna": {"title": "Tugtainer has RCE in Agent Command Execution Api", "source": {"advisory": "GHSA-grc3-8w5x-g54q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Quenary", "product": "tugtainer", "versions": [{"status": "affected", "version": "< 1.15.1"}]}], "references": [{"url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q", "name": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Quenary/tugtainer/pull/88", "name": "https://github.com/Quenary/tugtainer/pull/88", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831", "name": "https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Quenary/tugtainer/releases/tag/v1.15.1", "name": "https://github.com/Quenary/tugtainer/releases/tag/v1.15.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-29T15:51:41.461Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69201", "state": "PUBLISHED", "dateUpdated": "2025-12-29T16:50:49.919Z", "dateReserved": "2025-12-29T14:47:58.453Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-29T15:51:41.461Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue."}], "id": "CVE-2025-69201", "lastModified": "2025-12-29T16:15:43.940", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-12-29T16:15:43.940", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831"}, {"source": "security-advisories@github.com", "url": "https://github.com/Quenary/tugtainer/pull/88"}, {"source": "security-advisories@github.com", "url": "https://github.com/Quenary/tugtainer/releases/tag/v1.15.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Primary"}]}