Description

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.

INFO

Published Date :

2026-01-29T00:00:00.000Z

Last Modified :

2026-01-29T21:29:11.391Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2025-69516 vulnerability.

Vendors Products
Amidaware
  • Tactical Rmm
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-69516.

URL Resource
https://gist.github.com/NtGabrielGomes/7c424367cc316fd7527f668ff076fece cve-icon cve-icon
https://github.com/amidaware/tacticalrmm cve-icon cve-icon
https://www.amidaware.com/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact