GHSA-pw3r-7vg3-gqchCriticalCVSS 9.1
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates...
🔗 CVE IDs covered (1)
📋 Description
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129165
- https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/utils.py#L110-L117
- https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/views.py#L202-L245
- https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/tacticalrmm/utils.py#L227-L236
- https://vul.yulun.ac.cn/20261028/tacticalrmm
- https://www.vulncheck.com/advisories/tactical-rmm-0.17.0-through-1.6.1-arbitrary-file-read-via-report-preview
- https://github.com/advisories/GHSA-pw3r-7vg3-gqch