CVE-2025-69201

🗓️ 29 Dec 2025 15:51:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 6 Views🌐 WEB

CVE-2025-69201 enables remote code execution in Tugtainer before 1.15.1 via tugtainer-agent command run.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2025-69201	29 Dec 202520:28	–	circl
CNNVD	Tugtainer 命令注入漏洞	29 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-69201 Tugtainer has RCE in Agent Command Execution Api	29 Dec 202515:51	–	cvelist
EUVD	EUVD-2025-205598	29 Dec 202515:51	–	euvd
NVD	CVE-2025-69201	29 Dec 202516:15	–	nvd
OSV	CVE-2025-69201 Tugtainer has RCE in Agent Command Execution Api	29 Dec 202515:51	–	osv
Positive Technologies	PT-2025-53753	29 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-69201	30 Dec 202515:54	–	redhatcve
Vulnrichment	CVE-2025-69201 Tugtainer has RCE in Agent Command Execution Api	29 Dec 202515:51	–	vulnrichment

NVD

Vulners

Node

quenary tugtainerRange<1.15.1docker

[
  {
    "vendor": "Quenary",
    "product": "tugtainer",
    "versions": [
      {
        "version": "< 1.15.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831
github	www.github.com/Quenary/tugtainer/releases/tag/v1.15.1
github	www.github.com/Quenary/tugtainer/security/advisories/GHSA-grc3-8w5x-g54q
github	www.github.com/Quenary/tugtainer/pull/88

Parameter	Position	Path	Description	CWE
command	request body	api/command/run	Command injection via POST api/command/run where arbitrary arguments can be injected.	CWE-77
args	request body	api/command/run	Command injection via POST api/command/run where arbitrary arguments can be injected.	CWE-77

20 Feb 2026 16:55Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.19.8

CVSS 49.3

EPSS0.00037

SSVC

CWE-77