← Database

CVE-2026-129165

CRITICAL CVSS: 9.1 Published: 2026-11-13 Modified: 2026-11-13

Description

Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.

Affected Platforms

Unknown

Weakness Type

CWE-73

References