Arbitrary File Read Vulnerability in Tactical RMM by Amidaware
CVE-2026-129165

9.4CRITICAL

Key Information:

Vendor

Amidaware

Status
Tactical Rmm
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129165?

Tactical RMM versions 0.17.0 to 1.6.1 exhibit a vulnerability that allows unauthorized users to read arbitrary files through the /reporting/templates/preview/ endpoint. The weakness arises from WeasyPrint processing file:// links in the user-supplied template_md, enabling access to sensitive files, including the Django SECRET_KEY and other critical information. Users with report management permissions can exploit this vulnerability to execute unauthorized commands across managed agents, posing a significant security risk.

Affected Version(s)

Tactical RMM 0.17.0 <= 1.6.1

References

https://vul.yulun.ac.cn/20261028/tacticalrmm/
third-party-advisory
https://github.com/amidaware/tacticalrmm/blob/086e2d9714b...
technical-description
https://github.com/amidaware/tacticalrmm/blob/086e2d9714b...
technical-description

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.