CVE-2026-129165
Received Received - Intake

Arbitrary File Read in Tactical RMM via WeasyPrint Template

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-129165
EUVD
EUVD-2026-125602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AmidaWare Tactical RMM From 0.17.0 (inc) to 1.6.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tactical RMM versions 0.17.0 through 1.6.1 have an arbitrary file read vulnerability in the /reporting/templates/preview/ endpoint. The issue occurs because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. This allows users with report management permission to read sensitive files, including the Django SECRET_KEY which is reused as the NATS password.

Detection Guidance

To detect this vulnerability, check if your Tactical RMM version is between 0.17.0 and 1.6.1. Inspect network traffic for requests to /reporting/templates/preview/ with user-supplied template_md parameters. Look for unauthorized access to sensitive files like Django SECRET_KEY.

Impact Analysis

This vulnerability allows attackers with report management permissions to read sensitive files like the Django SECRET_KEY, which is reused as the NATS password. This could lead to unauthorized access to the system, potential command execution on managed agents via runscript commands, and compromise of the entire RMM infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security and privacy rules. The exposure of the SECRET_KEY and potential access to managed systems may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Immediately upgrade Tactical RMM to a version beyond 1.6.1. Restrict report management permissions to trusted users only. Rotate the Django SECRET_KEY and NATS password. Monitor for unusual PDF generation requests or unauthorized file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129165. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...